morgan pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

5 changed files:

Changes:

  • .gitlab/issue_templates/Release Prep - Mullvad Browser Alpha.md
    1 
    +- **NOTE** It is assumed the `mullvad-browser` alpha rebase and security backport tasks have been completed
    2 
    +- **NOTE** This can/is often done in conjunction with the equivalent Tor Browser release prep issue
    3 
    +
    1 4 
     <details>
    2 5 
       <summary>Explanation of variables</summary>
    3 6
    4 
    -- `$(BUILD_SERVER)` : the server the main builder is using to build a mullvad-browser release
    5 
    -- `$(BUILDER)` : whomever is building the release on the $(BUILD_SERVER)
    6 
    -  - **example** : `pierov`
    7 
    -- `$(STAGING_SERVER)` : the server the signer is using to to run the signing process
    8 
    -- `$(ESR_VERSION)` : the Mozilla defined ESR version, used in various places for building mullvad-browser tags, labels, etc
    9 
    -  - **example** : `91.6.0`
    10 
    -- `$(MULLVAD_BROWSER_MAJOR)` : the Mullvad Browser major version
    11 
    -  - **example** : `11`
    12 
    -- `$(MULLVAD_BROWSER_MINOR)` : the Mullvad Browser minor version
    13 
    -  - **example** : either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    14 
    -- `$(MULLVAD_BROWSER_VERSION)` : the Mullvad Browser version in the format
    15 
    -  - **example** : `12.5a3`, `12.0.3`
    16 
    -- `$(BUILD_N)` : a project's build revision within a its branch; this is separate from the `$(MULLVAD_BROWSER_BUILD_N)` value; many of the Firefox-related projects have a `$(BUILD_N)` suffix and may differ between projects even when they contribute to the same build.
    17 
    -    - **example** : `build1`
    18 
    -- `$(MULLVAD_BROWSER_BUILD_N)` : the mullvad-browser build revision for a given Mullvad Browser release; used in tagging git commits
    19 
    -    - **example** : `build2`
    20 
    -    - **NOTE** : A project's `$(BUILD_N)` and `$(MULLVAD_BROWSER_BUILD_N)` may be the same, but it is possible for them to diverge. For **example** :
    21 
    -      - if we have multiple Mullvad Browser releases on a given ESR branch the two will become out of sync as the `$(BUILD_N)` value will increase, while the `$(MULLVAD_BROWSER_BUILD_N)` value may stay at `build1` (but the `$(MULLVAD_BROWSER_VERSION)` will increase)
    22 
    -      - if we have build failures unrelated to `mullvad-browser`, the `$(MULLVAD_BROWSER_BUILD_N)` value will increase while the `$(BUILD_N)` will stay the same.
    23 
    -- `$(MULLVAD_BROWSER_VERSION)` : the published Mullvad Browser version
    24 
    -    - **example** : `11.5a6`, `11.0.7`
    25 
    -- `$(MB_BUILD_TAG)` : the `tor-browser-build` build tag used to build a given Mullvad Browser version
    26 
    -    - **example** : `mb-12.0.7-build1`
    27 
    -</details>
    28 
    -
    29 
    -**NOTE** It is assumed that the `tor-browser` alpha rebase and security backport tasks have been completed
    7 
    +- `${BUILD_SERVER}`: the server the main builder is using to build a browser release
    8 
    +- `${BUILDER}`: whomever is building the release on the ${BUILD_SERVER}
    9 
    +  - **example**: `pierov`
    10 
    +- `${STAGING_SERVER}`: the server the signer is using to to run the signing process
    11 
    +- `${ESR_VERSION}`: the Mozilla defined ESR version, used in various places for building browser tags, labels, etc
    12 
    +  - **example**: `91.6.0`
    13 
    +- `${MULLVAD_BROWSER_MAJOR}`: the Mullvad Browser major version
    14 
    +  - **example**: `11`
    15 
    +- `${MULLVAD_BROWSER_MINOR}`: the Mullvad Browser minor version
    16 
    +  - **example**: either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    17 
    +- `${MULLVAD_BROWSER_VERSION}`: the Mullvad Browser version in the format
    18 
    +  - **example**: `12.5a3`, `12.0.3`
    19 
    +- `${BUILD_N}`: a project's build revision within a its branch; this is separate from the `${MULLVAD_BROWSER_BUILD_N}` value; many of the Firefox-related projects have a `${BUILD_N}` suffix and may differ between projects even when they contribute to the same build.
    20 
    +  - **example**: `build1`
    21 
    +- `${MULLVAD_BROWSER_BUILD_N}`: the mullvad-browser build revision for a given Mullvad Browser release; used in tagging git commits
    22 
    +  - **example**: `build2`
    23 
    +    - **⚠️ WARNING**: A project's `${BUILD_N}` and `${MULLVAD_BROWSER_BUILD_N}` may be the same, but it is possible for them to diverge. For **example** :
    24 
    +      - if we have multiple Mullvad Browser releases on a given ESR branch the two will become out of sync as the `${BUILD_N}` value will increase, while the `${MULLVAD_BROWSER_BUILD_N}` value may stay at `build1` (but the `${MULLVAD_BROWSER_VERSION}` will increase)
    25 
    +      - if we have build failures unrelated to `mullvad-browser`, the `${MULLVAD_BROWSER_BUILD_N}` value will increase while the `${BUILD_N}` will stay the same.
    26 
    +- `${MULLVAD_BROWSER_VERSION}`: the published Mullvad Browser version
    27 
    +    - **example**: `11.5a6`, `11.0.7`
    28 
    +- `${MB_BUILD_TAG}`: the `tor-browser-build` build tag used to build a given Mullvad Browser version
    29 
    +  - **example**: `mb-12.0.7-build1`
    30 
    +- `${RELEASE_DATE}`: the intended release date of this browser release; for ESR schedule-driven releases, this should match the upstream Firefox release date
    31 
    +  - **example**: `2024-10-29`
    30 32
    31 
    -**NOTE** This can/is often done in conjunction with the equivalent Tor Browser release prep issue
    33 
    +</details>
    32 34
    33 35 
     <details>
    34 
    -  <summary>Building</summary>
    36 
    +  <summary>Build Configuration</summary>
    35 37
    36 38 
     ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    37 39 
     Mullvad Browser Alpha (and Nightly) are on the `main` branch
    38 40
    39 
    -- [ ] Update `rbm.conf`
    40 
    -  - [ ] `var/torbrowser_version` : update to next version
    41 
    -  - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)`
    42 
    -  - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building.
    43 
    -  - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version
    44 
    -    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    45 
    -    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail
    46 
    -- [ ] Update build configs
    47 
    -  - [ ] Update `projects/firefox/config`
    48 
    -    - [ ] `browser_build` : update to match `mullvad-browser` tag
    49 
    -    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    50 
    -  - [ ] Update `projects/translation/config`:
    51 
    -    - [ ] run `make list_translation_updates-alpha` to get updated hashes
    52 
    -    - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    53 
    -    - [ ] `steps/mullvad-browser/git_hash` : update with `HEAD` commit of project's `mullvad-browser` branch
    54 
    -- [ ] Update common build configs
    55 
    -  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    56 
    -    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    57 
    -      - [ ] `URL`
    58 
    -      - [ ] `sha256sum`
    59 
    -  - [ ] Check for uBlock-origin updates here : https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
    60 
    -    - [ ] ***(Optional)*** If new version available, update `ublock-origin` section of `input_files` in `projects/browser/config`
    61 
    -      - [ ] `URL`
    62 
    -      - [ ] `sha256sum`
    63 
    -  - [ ] Check for Mullvad Browser Extension updates here : https://github.com/mullvad/browser-extension/releases
    64 
    -    - [ ] ***(Optional)*** If new version available, update `mullvad-extension` section of `input_files` in `projects/browser/config`
    65 
    -      - [ ] `URL`
    66 
    -      - [ ] `sha256sum`
    67 
    -- [ ] Update `ChangeLog-MB.txt`
    68 
    -  - [ ] Ensure `ChangeLog-MB.txt` is sync'd between alpha and stable branches
    69 
    -  - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    70 
    -  - [ ] Run `./tools/fetch_changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    71 
    -    - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    72 
    -    - The first time you run this script you will need to generate an access token; the script will guide you
    73 
    -    - `$updateArgs` should be these arguments, depending on what you actually updated:
    74 
    -      - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    75 
    -      - [ ] `--no-script`
    76 
    -      - [ ] `--ublock`
    77 
    -      - E.g., `./tools/fetch_changelogs.py 41029 --date 'December 19 2023' --firefox 115.6.0esr --no-script 11.4.29 --ublock 1.54.0`
    78 
    -    - `--date $date` is optional, if omitted it will be the date on which you run the command
    79 
    -  - [ ] Copy the output of the script to the beginning of `ChangeLog-MB.txt` and adjust its output
    41 
    +- [ ] Tag `mullvad-browser` in mullvad-browser.git
    42 
    +  - **example**: `mullvad-browser-128.3.0esr-14.0-1-build1`
    43 
    +- [ ] Changelog bookkeeping:
    44 
    +  - [ ] Ensure all commits to `mullvad-browser` and `tor-browser-build` for this release have an associated issue linked to this release preparation issue
    45 
    +  - [ ] Ensure each issue has a platform (~Windows, ~MacOS, ~Linux, ~Desktop, ~"All Platforms") and potentially ~"Build System" labels
    46 
    +- [ ] Create a release preparation branch from the `main` branch
    47 
    +- [ ] Run release preparation script:
    48 
    +  - **NOTE**: You can omit the `--mullvad-browser` argument if this is for a joint Tor and Mullvad Browser release
    49 
    +  ```bash
    50 
    +  ./tools/relprep.py --mullvad-browser  --date ${RELEASE_DATE} ${MULLVAD_BROWSER_VERSION}
    51 
    +  ```
    52 
    +  - **⚠️ WARNING**: You may need to manually update the `firefox/config` file's `browser_build` field if `mullvad-browser.git` has not yet been tagged (e.g. if security backports have not yet been merged and tagged)
    53 
    +- [ ] Review build configuration changes:
    54 
    +  - [ ] `rbm.conf`
    55 
    +    - [ ] `var/torbrowser_version`: updated to next browser version
    56 
    +    - [ ] `var/torbrowser_build`: updated to `${MULLVAD_BROWSER_BUILD_N}`
    57 
    +    - [ ] `var/browser_release_date`: updated to build date. For the build to be reproducible, the date should be in the past when building.
    58 
    +      - **⚠️ WARNING**: If we have updated `var/torbrowser_build` without updating the `firefox` tag, then we can leave this unchanged to avoid forcing a firefox re-build (e.g. when bumping `var/torbrwoser_build` to build2, build3, etc due to non-firefox related build issues)
    59 
    +    - [ ] `var/torbrowser_incremental_from`: updated to previous Desktop version
    60 
    +      - **NOTE**: We try to build incrementals for the previous 3 desktop versions
    61 
    +      - **⚠️ WARNING**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    62 
    +  - [ ] `projects/firefox/config`
    63 
    +    - [ ] `browser_build`: updated to match `mullvad-browser` tag
    64 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
    65 
    +  - [ ] ***(Optional)*** `projects/translation/config`:
    66 
    +    - [ ] `steps/base-browser/git_hash`: updated with `HEAD` commit of project's `base-browser` branch
    67 
    +    - [ ] `steps/mullvad-browser/git_hash`: updated with `HEAD` commit of project's `mullvad-browser` branch
    68 
    +  - [ ] ***(Optional)*** `projects/browser/config`:
    69 
    +    - [ ] NoScript: https://addons.mozilla.org/en-US/firefox/addon/noscript
    70 
    +      - [ ] `URL` updated
    71 
    +        - **⚠️ WARNING**: If preparing the release manually, updating the version number in the url is not sufficient, as each version has a random unique id in the download url
    72 
    +      - [ ] `sha256sum` updated
    73 
    +    - [ ] uBlock-origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin
    74 
    +      - [ ] `URL` updated
    75 
    +        - **⚠️ WARNING**: If preparing the release manually, updating the version number in the url is not sufficient, as each version has a random unique id in the download url
    76 
    +      - [ ] `sha256sum` updated
    77 
    +    - [ ] Mullvad Browser extension: https://github.com/mullvad/browser-extension/releases
    78 
    +      - [ ] `URL` updated
    79 
    +      - [ ] `sha256sum` updated
    80 
    +  - [ ] `ChangeLog-MB.txt`: ensure correctness
    81 
    +    - [ ] Browser name correct
    82 
    +    - [ ] Release date correct
    83 
    +    - [ ] No Android updates
    84 
    +    - [ ] All issues added under correct platform
    85 
    +    - [ ] ESR updates correct
    86 
    +    - [ ] Component updates correct
    80 87 
     - [ ] Open MR with above changes, using the template for release preparations
    81 88 
     - [ ] Merge
    82 89 
     - [ ] Sign+Tag
    ... ... @@ -86,16 +93,25 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch
    86 93 
         - ma1
    87 94 
         - morgan
    88 95 
         - pierov
    89 
    -  - [ ] Run: `make mullvadbrowser-signtag-alpha`
    96 
    +  - [ ] Run:
    97 
    +    ```
    98 
    +    make mullvadbrowser-signtag-alpha
    99 
    +    ```
    90 100 
       - [ ] Push tag to `upstream`
    91 101 
     - [ ] Build the tag:
    92 
    -  - Run `make mullvadbrowser-alpha && make mullvadbrowser-incrementals-alpha` on:
    102 
    +  - [ ] Run:
    103 
    +    ```
    104 
    +    make mullvadbrowser-alpha && make mullvadbrowser-incrementals-alpha
    105 
    +    ```
    93 106 
         - [ ] Tor Project build machine
    94 107 
         - [ ] Local developer machine
    95 108 
       - [ ] Submit build request to Mullvad infrastructure:
    96 109 
         - **NOTE** this requires a devmole authentication token
    97 
    -    - Run `make mullvadbrowser-kick-devmole-build`
    98 
    -- [ ] Ensure builders have matching builds
    110 
    +    - [ ] Run:
    111 
    +      ```
    112 
    +      make mullvadbrowser-kick-devmole-build
    113 
    +      ```
    114 
    +- [ ] Ensure all builders have matching builds
    99 115
    100 116 
     </details>
    101 117
    ... ... @@ -105,64 +121,78 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch
    105 121 
     ### release signing
    106 122 
     - [ ] Assign this issue to the signer, one of:
    107 123 
       - boklm
    124 
    +  - ma1
    108 125 
       - morgan
    109 
    -- [ ] On `$(STAGING_SERVER)`, ensure updated:
    110 
    -  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N) && git checkout tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N)`
    126 
    +  - pierov
    127 
    +- [ ] Ensure all builders have matching builds
    128 
    +- [ ] On `${STAGING_SERVER}`, ensure updated:
    129 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-${MULLVAD_BROWSER_VERSION}-${MULLVAD_BROWSER_BUILD_N} && git checkout tbb-${MULLVAD_BROWSER_VERSION}-${MULLVAD_BROWSER_BUILD_N}`
    111 130 
       - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    112 
    -    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    113 
    -      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    114 
    -    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    131 
    +    - `ssh_host_builder`: ssh hostname of machine with unsigned builds
    132 
    +    - `ssh_host_linux_signer`: ssh hostname of linux signing machine
    133 
    +    - `builder_tor_browser_build_dir`: path on `ssh_host_builder` to root of builder's `tor-browser-build` clone containing unsigned builds
    115 134 
       - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    116 
    -    - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    135 
    +    - `appstoreconnect_api_key_path`: path to json file containing appstoreconnect api key infos
    117 136 
       - [ ] `set-config.update-responses`
    118 
    -    - `update_responses_repository_dir` : directory where you cloned `git@gitlab.torproject.org:tpo/applications/mullvad-browser-update-responses.git`
    137 
    +    - `update_responses_repository_dir`: directory where you cloned `git@gitlab.torproject.org:tpo/applications/mullvad-browser-update-responses.git`
    119 138 
       - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    120 
    -    - `tbb_version` : mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    121 
    -    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    122 
    -    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    123 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    124 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    125 
    -  - `cd tor-browser-build/tools/signing/`
    126 
    -  - `./do-all-signing.mullvadbrowser`
    127 
    -- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    128 
    -- [ ] Update `staticiforme.torproject.org`:
    129 
    -  - From `screen` session on `staticiforme.torproject.org`:
    130 
    -  - [ ] Remove old release data from `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    131 
    -  - [ ] Static update components (again) : `static-update-component dist.torproject.org`
    139 
    +    - `tbb_version`: mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    140 
    +    - `tbb_version_build`: the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    141 
    +    - `tbb_version_type`: either `alpha` for alpha releases or `release` for stable releases
    142 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    143 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, run do-all-signing script:
    144 
    +  - [ ] Run:
    145 
    +    ```
    146 
    +    cd tor-browser-build/tools/signing/ && ./do-all-signing.mullvadbrowser
    147 
    +    ```
    148 
    +  - **NOTE**: on successful execution, the signed binaries and mars should have been copied to `staticiforme` and update responses pushed
    132 149
    133 150 
     </details>
    134 151
    135 152 
     <details>
    136 153 
       <summary>Publishing</summary>
    137 154
    155 
    +### website
    156 
    +- [ ] On `staticiforme.torproject.org`, remove old release and publish new:
    157 
    +  - [ ] `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    158 
    +  - [ ] Run:
    159 
    +    ```
    160 
    +    static-update-component dist.torproject.org
    161 
    +    ```
    162 
    +
    138 163 
     ### mullvad-browser (GitHub): https://github.com/mullvad/mullvad-browser/
    139 164 
     - [ ] Assign this issue to someone with mullvad commit access, one of:
    140 165 
         - boklm
    141 166 
         - ma1
    142 167 
         - morgan
    143 168 
         - pierov
    169 
    +- [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    170 
    +  - **Tag**: `${MULLVAD_BROWSER_VERSION}`
    171 
    +    - **example**: `12.5a7`
    172 
    +  - **Message**: `${ESR_VERSION}esr-based ${MULLVAD_BROWSER_VERSION}`
    173 
    +    - **example**: `102.12.0esr-based 12.5a7`
    144 174 
     - [ ] Push this release's associated `mullvad-browser.git` branch to github
    145 175 
     - [ ] Push this release's associated tags to github:
    146 176 
       - [ ] Firefox ESR tag
    147 
    -    - **example** : `FIREFOX_102_12_0esr_BUILD1`
    177 
    +    - **example**: `FIREFOX_102_12_0esr_BUILD1`
    148 178 
       - [ ] `base-browser` tag
    149 
    -    - **example** : `base-browser-102.12.0esr-12.0-1-build1`
    150 
    -  - [ ] `mullvad-browser` tag
    151 
    -    - **example** : `mullvad-browser-102.12.0esr-12.0-1-build1`
    152 
    -- [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    153 
    -  - **Tag**: `$(MULLVAD_BROWSER_VERSION)`
    154 
    -    - **example** : `12.5a7`
    155 
    -  - **Message**: `$(ESR_VERSION)esr-based $(MULLVAD_BROWSER_VERSION)`
    156 
    -    - **example** : `102.12.0esr-based 12.5a7`
    157 
    -  - [ ] Push tag to github
    158 
    -
    159 
    -### email
    160 
    -- [ ] **(Once branch+tags pushed to GitHub)** Email Mullvad with release information:
    161 
    -  - [ ] support alias: support@mullvadvpn.net
    162 
    -  - [ ] Rui: rui@mullvad.net
    179 
    +    - **example**: `base-browser-102.12.0esr-12.0-1-build1`
    180 
    +  - [ ] `mullvad-browser` build tag
    181 
    +    - **example**: `mullvad-browser-102.12.0esr-12.0-1-build1`
    182 
    +  - [ ] `mullvad-browser` release tag
    183 
    +    - **example**: `12.0.11`
    184 
    +
    185 
    +### Mullvad
    186 
    +- [ ] Email Mullvad with release information:
    187 
    +  - **Recipients**
    188 
    +    - Mullvad support alias: support@mullvadvpn.net
    189 
    +    - Rui Hildt: rui@mullvad.net
    190 
    +    ```
    191 
    +    support@mullvadvpn.net rui@mullvad.net
    192 
    +    ```
    163 193 
       - **Subject**
    164 194 
         ```
    165 
    -    New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    195 
    +    New build: Mullvad Browser ${MULLVAD_BROWSER_VERION} (signed)
    166 196 
         ```
    167 197 
       - **Body**
    168 198 
         ```
    ... ... @@ -170,28 +200,34 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch
    170 200
    171 201 
         Branch+Tags have been pushed to Mullvad's GitHub repo.
    172 202
    173 
    -    - signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    174 
    -    - update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    203 
    +    - signed builds: https://dist.torproject.org/mullvadbrowser/${MULLVAD_BROWSER_VERSION}
    204 
    +    - update_response hashes: ${MULLVAD_UPDATE_RESPONSES_HASH}
    175 205
    176 206 
         changelog:
    207 
    +    # paste changelog as quote here
    177 208 
         ...
    178 209 
         ```
    179 210
    180 211 
     </details>
    181 212
    182 213 
     <details>
    183 
    -  <summary>Downstream</summary>
    214 
    +  <summary>Packaging</summary>
    184 215
    185 
    -### notify packagers
    186 
    -These steps depend on Mullvad having updated their [GitHub Releases](https://github.com/mullvad/mullvad-browser/releases/) page with the latest release
    187 
    -- [ ] **(Optional)** Email downstream consumers:
    216 
    +
    217 
    +
    218 
    +### packagers
    219 
    +- [ ] **(Optional, Once Packages are pushed to GitHub)**
    188 220 
       - **NOTE**: This is an optional step and only necessary close a major release/transition from alpha to stable, or if there are major packing changes these developers need to be aware of
    189 
    -  - [ ] flathub package maintainer: proletarius101@protonmail.com
    190 
    -  - [ ] arch package maintainer: bootctl@gmail.com
    191 
    -  - [ ] nixOS package maintainer: dev@felschr.com
    221 
    +  - **Recipients**
    222 
    +    - flathub package maintainer: proletarius101@protonmail.com
    223 
    +    - arch package maintainer: bootctl@gmail.com
    224 
    +    - nixOS package maintainer: dev@felschr.com
    225 
    +    ```
    226 
    +    proletarius101@protonmail.com bootctl@gmail.com dev@felschr.com
    227 
    +    ```
    192 228 
       - **Subject**
    193 229 
         ```
    194 
    -    Mullvad Browser $(MULLVAD_BROWSER_VERSION) released
    230 
    +    Mullvad Browser ${MULLVAD_BROWSER_VERSION} released
    195 231 
         ```
    196 232 
       - **Body**
    197 233 
         ```
    ... ... @@ -208,4 +244,3 @@ These steps depend on Mullvad having updated their [GitHub Releases](https://git
    208 244
    209 245 
     /label ~"Release Prep"
    210 246 
     /label ~"Sponsor 131"
    211 
    -

  • .gitlab/issue_templates/Release Prep - Mullvad Browser Stable.md
    1 
    +- **NOTE** It is assumed the `mullvad-browser` release rebase and security backport tasks have been completed
    2 
    +- **NOTE** This can/is often done in conjunction with the equivalent Tor Browser release prep issue
    3 
    +
    1 4 
     <details>
    2 5 
       <summary>Explanation of variables</summary>
    3 6
    4 
    -- `$(BUILD_SERVER)` : the server the main builder is using to build a mullvad-browser release
    5 
    -- `$(BUILDER)` : whomever is building the release on the $(BUILD_SERVER)
    6 
    -  - **example** : `pierov`
    7 
    -- `$(STAGING_SERVER)` : the server the signer is using to to run the signing process
    8 
    -- `$(ESR_VERSION)` : the Mozilla defined ESR version, used in various places for building mullvad-browser tags, labels, etc
    9 
    -  - **example** : `91.6.0`
    10 
    -- `$(MULLVAD_BROWSER_MAJOR)` : the Mullvad Browser major version
    11 
    -  - **example** : `11`
    12 
    -- `$(MULLVAD_BROWSER_MINOR)` : the Mullvad Browser minor version
    13 
    -  - **example** : either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    14 
    -- `$(MULLVAD_BROWSER_VERSION)` : the Mullvad Browser version in the format
    15 
    -  - **example** : `12.5a3`, `12.0.3`
    16 
    -- `$(BUILD_N)` : a project's build revision within a its branch; this is separate from the `$(MULLVAD_BROWSER_BUILD_N)` value; many of the Firefox-related projects have a `$(BUILD_N)` suffix and may differ between projects even when they contribute to the same build.
    17 
    -    - **example** : `build1`
    18 
    -- `$(MULLVAD_BROWSER_BUILD_N)` : the mullvad-browser build revision for a given Mullvad Browser release; used in tagging git commits
    19 
    -    - **example** : `build2`
    20 
    -    - **NOTE** : A project's `$(BUILD_N)` and `$(MULLVAD_BROWSER_BUILD_N)` may be the same, but it is possible for them to diverge. For **example** :
    21 
    -      - if we have multiple Mullvad Browser releases on a given ESR branch the two will become out of sync as the `$(BUILD_N)` value will increase, while the `$(MULLVAD_BROWSER_BUILD_N)` value may stay at `build1` (but the `$(MULLVAD_BROWSER_VERSION)` will increase)
    22 
    -      - if we have build failures unrelated to `mullvad-browser`, the `$(MULLVAD_BROWSER_BUILD_N)` value will increase while the `$(BUILD_N)` will stay the same.
    23 
    -- `$(MULLVAD_BROWSER_VERSION)` : the published Mullvad Browser version
    24 
    -    - **example** : `11.5a6`, `11.0.7`
    25 
    -- `$(MB_BUILD_TAG)` : the `tor-browser-build` build tag used to build a given Mullvad Browser version
    26 
    -    - **example** : `mb-12.0.7-build1`
    27 
    -</details>
    28 
    -
    29 
    -**NOTE** It is assumed that the `tor-browser` stable rebase and security backport tasks have been completed
    7 
    +- `${BUILD_SERVER}`: the server the main builder is using to build a browser release
    8 
    +- `${BUILDER}`: whomever is building the release on the ${BUILD_SERVER}
    9 
    +  - **example**: `pierov`
    10 
    +- `${STAGING_SERVER}`: the server the signer is using to to run the signing process
    11 
    +- `${ESR_VERSION}`: the Mozilla defined ESR version, used in various places for building browser tags, labels, etc
    12 
    +  - **example**: `91.6.0`
    13 
    +- `${MULLVAD_BROWSER_MAJOR}`: the Mullvad Browser major version
    14 
    +  - **example**: `11`
    15 
    +- `${MULLVAD_BROWSER_MINOR}`: the Mullvad Browser minor version
    16 
    +  - **example**: either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    17 
    +- `${MULLVAD_BROWSER_VERSION}`: the Mullvad Browser version in the format
    18 
    +  - **example**: `12.5a3`, `12.0.3`
    19 
    +- `${BUILD_N}`: a project's build revision within a its branch; this is separate from the `${MULLVAD_BROWSER_BUILD_N}` value; many of the Firefox-related projects have a `${BUILD_N}` suffix and may differ between projects even when they contribute to the same build.
    20 
    +  - **example**: `build1`
    21 
    +- `${MULLVAD_BROWSER_BUILD_N}`: the mullvad-browser build revision for a given Mullvad Browser release; used in tagging git commits
    22 
    +  - **example**: `build2`
    23 
    +    - **⚠️ WARNING**: A project's `${BUILD_N}` and `${MULLVAD_BROWSER_BUILD_N}` may be the same, but it is possible for them to diverge. For **example** :
    24 
    +      - if we have multiple Mullvad Browser releases on a given ESR branch the two will become out of sync as the `${BUILD_N}` value will increase, while the `${MULLVAD_BROWSER_BUILD_N}` value may stay at `build1` (but the `${MULLVAD_BROWSER_VERSION}` will increase)
    25 
    +      - if we have build failures unrelated to `mullvad-browser`, the `${MULLVAD_BROWSER_BUILD_N}` value will increase while the `${BUILD_N}` will stay the same.
    26 
    +- `${MULLVAD_BROWSER_VERSION}`: the published Mullvad Browser version
    27 
    +    - **example**: `11.5a6`, `11.0.7`
    28 
    +- `${MB_BUILD_TAG}`: the `tor-browser-build` build tag used to build a given Mullvad Browser version
    29 
    +   - **example**: `mb-12.0.7-build1`
    30 
    +- `${RELEASE_DATE}`: the intended release date of this browser release; for ESR schedule-driven releases, this should match the upstream Firefox release date
    31 
    +  - **example**: `2024-10-29`
    30 32
    31 
    -**NOTE** This can/is often done in conjunction with the equivalent Tor Browser release prep issue
    33 
    +</details>
    32 34
    33 35 
     <details>
    34 
    -  <summary>Building</summary>
    36 
    +  <summary>Build Configuration</summary>
    35 37
    36 38 
     ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    37 
    -Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MULLVAD_BROWSER_MINOR)` (and possibly more specific) branches
    38 
    -
    39 
    -- [ ] Update `rbm.conf`
    40 
    -  - [ ] `var/torbrowser_version` : update to next version
    41 
    -  - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)`
    42 
    -  - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building.
    43 
    -  - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version
    44 
    -    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    45 
    -    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail
    46 
    -- [ ] Update build configs
    47 
    -  - [ ] Update `projects/firefox/config`
    48 
    -    - [ ] `browser_build` : update to match `mullvad-browser` tag
    49 
    -    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    50 
    -  - [ ] Update `projects/translation/config`:
    51 
    -    - [ ] run `make list_translation_updates-release` to get updated hashes
    52 
    -    - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    53 
    -    - [ ] `steps/mullvad-browser/git_hash` : update with `HEAD` commit of project's `mullvad-browser` branch
    54 
    -- [ ] Update common build configs
    55 
    -  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    56 
    -    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    57 
    -      - [ ] `URL`
    58 
    -      - [ ] `sha256sum`
    59 
    -  - [ ] Check for uBlock-origin updates here : https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
    60 
    -    - [ ] ***(Optional)*** If new version available, update `ublock-origin` section of `input_files` in `projects/browser/config`
    61 
    -      - [ ] `URL`
    62 
    -      - [ ] `sha256sum`
    63 
    -  - [ ] Check for Mullvad Browser Extension updates here : https://github.com/mullvad/browser-extension/releases
    64 
    -    - [ ] ***(Optional)*** If new version available, update `mullvad-extension` section of `input_files` in `projects/browser/config`
    65 
    -      - [ ] `URL`
    66 
    -      - [ ] `sha256sum`
    67 
    -- [ ] Update `ChangeLog-MB.txt`
    68 
    -  - [ ] Ensure `ChangeLog-MB.txt` is sync'd between alpha and stable branches
    69 
    -  - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    70 
    -  - [ ] Run `./tools/fetch-changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    71 
    -    - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    72 
    -    - The first time you run this script you will need to generate an access token; the script will guide you
    73 
    -    - `$updateArgs` should be these arguments, depending on what you actually updated:
    74 
    -      - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    75 
    -      - [ ] `--no-script`
    76 
    -      - [ ] `--ublock`
    77 
    -      - E.g., `./tools/fetch-changelogs.py 41029 --date 'December 19 2023' --firefox 115.6.0esr --no-script 11.4.29 --ublock 1.54.0`
    78 
    -    - `--date $date` is optional, if omitted it will be the date on which you run the command
    79 
    -  - [ ] Copy the output of the script to the beginning of `ChangeLog-MB.txt` and adjust its output
    39 
    +Mullvad Browser Release are on the `maint-${MULLVAD_BROWSER_MAJOR}.${MULLVAD_BROWSER_MINOR}` branch
    40 
    +
    41 
    +- [ ] Tag `mullvad-browser` in mullvad-browser.git
    42 
    +  - **example**: `mullvad-browser-128.3.0esr-14.0-1-build1`
    43 
    +- [ ] Changelog bookkeeping:
    44 
    +  - [ ] Ensure all commits to `mullvad-browser` and `tor-browser-build` for this release have an associated issue linked to this release preparation issue
    45 
    +  - [ ] Ensure each issue has a platform (~Windows, ~MacOS, ~Linux, ~Desktop, ~"All Platforms") and potentially ~"Build System" labels
    46 
    +- [ ] Create a release preparation branch from the current `maint-XX.Y` branch
    47 
    +- [ ] Run release preparation script:
    48 
    +  - **NOTE**: You can omit the `--mullvad-browser` argument if this is for a joint Tor and Mullvad Browser release
    49 
    +  ```bash
    50 
    +  ./tools/relprep.py --mullvad-browser --date ${RELEASE_DATE} ${MULLVAD_BROWSER_VERSION}
    51 
    +  ```
    52 
    +  - **⚠️ WARNING**: You may need to manually update the `firefox/config` file's `browser_build` field if `mullvad-browser.git` has not yet been tagged (e.g. if security backports have not yet been merged and tagged)
    53 
    +- [ ] Review build configuration changes:
    54 
    +  - [ ] `rbm.conf`
    55 
    +    - [ ] `var/torbrowser_version`: updated to next browser version
    56 
    +    - [ ] `var/torbrowser_build`: updated to `${MULLVAD_BROWSER_BUILD_N}`
    57 
    +    - [ ] `var/browser_release_date`: updated to build date. For the build to be reproducible, the date should be in the past when building.
    58 
    +      - **⚠️ WARNING**: If we have updated `var/torbrowser_build` without updating the `firefox` tag, then we can leave this unchanged to avoid forcing a firefox re-build (e.g. when bumping `var/torbrwoser_build` to build2, build3, etc due to non-firefox related build issues)
    59 
    +    - [ ] `var/torbrowser_incremental_from`: updated to previous Desktop version
    60 
    +      - **NOTE**: We try to build incrementals for the previous 3 desktop versions
    61 
    +      - **⚠️ WARNING**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    62 
    +  - [ ] `projects/firefox/config`
    63 
    +    - [ ] `browser_build`: updated to match `mullvad-browser` tag
    64 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
    65 
    +  - [ ] ***(Optional)*** `projects/translation/config`:
    66 
    +    - [ ] `steps/base-browser/git_hash`: updated with `HEAD` commit of project's `base-browser` branch
    67 
    +    - [ ] `steps/mullvad-browser/git_hash`: updated with `HEAD` commit of project's `mullvad-browser` branch
    68 
    +  - [ ] ***(Optional)*** `projects/browser/config`:
    69 
    +    - [ ] NoScript: https://addons.mozilla.org/en-US/firefox/addon/noscript
    70 
    +      - [ ] `URL` updated
    71 
    +        - **⚠️ WARNING**: If preparing the release manually, updating the version number in the url is not sufficient, as each version has a random unique id in the download url
    72 
    +      - [ ] `sha256sum` updated
    73 
    +    - [ ] uBlock-origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin
    74 
    +      - [ ] `URL` updated
    75 
    +        - **⚠️ WARNING**: If preparing the release manually, updating the version number in the url is not sufficient, as each version has a random unique id in the download url
    76 
    +      - [ ] `sha256sum` updated
    77 
    +    - [ ] Mullvad Browser extension: https://github.com/mullvad/browser-extension/releases
    78 
    +      - [ ] `URL` updated
    79 
    +      - [ ] `sha256sum` updated
    80 
    +  - [ ] `ChangeLog-MB.txt`: ensure correctness
    81 
    +    - [ ] Browser name correct
    82 
    +    - [ ] Release date correct
    83 
    +    - [ ] No Android updates
    84 
    +    - [ ] All issues added under correct platform
    85 
    +    - [ ] ESR updates correct
    86 
    +    - [ ] Component updates correct
    80 87 
     - [ ] Open MR with above changes, using the template for release preparations
    81 88 
     - [ ] Merge
    82 89 
     - [ ] Sign+Tag
    ... ... @@ -86,16 +93,24 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    86 93 
         - ma1
    87 94 
         - morgan
    88 95 
         - pierov
    89 
    -  - [ ] Run: `make mullvadbrowser-signtag-release`
    96 
    +  - [ ] Run:
    97 
    +    ```
    98 
    +    make mullvadbrowser-signtag-release
    99 
    +    ```
    90 100 
       - [ ] Push tag to `upstream`
    91 101 
     - [ ] Build the tag:
    92 
    -  - Run `make mullvadbrowser-release && make mullvadbrowser-incrementals-release`
    102 
    +  - [ ] Run:
    103 
    +    ```
    104 
    +    make mullvadbrowser-release && make mullvadbrowser-incrementals-release
    105 
    +    ```
    93 106 
         - [ ] Tor Project build machine
    94 107 
         - [ ] Local developer machine
    95 108 
       - [ ] Submit build request to Mullvad infrastructure:
    96 109 
         - **NOTE** this requires a devmole authentication token
    97 
    -    - Run `make mullvadbrowser-kick-devmole-build`
    98 
    -- [ ] Ensure builders have matching builds
    110 
    +    - [ ] Run:
    111 
    +      ```
    112 
    +      make mullvadbrowser-kick-devmole-build
    113 
    +      ```
    99 114
    100 115 
     </details>
    101 116
    ... ... @@ -105,64 +120,79 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    105 120 
     ### release signing
    106 121 
     - [ ] Assign this issue to the signer, one of:
    107 122 
       - boklm
    123 
    +  - ma1
    108 124 
       - morgan
    109 
    -- [ ] On `$(STAGING_SERVER)`, ensure updated:
    110 
    -  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N) && git checkout tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N)`
    111 
    -  - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    112 
    -    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    113 
    -      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    114 
    -    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    125 
    +  - pierov
    126 
    +- [ ] Ensure all builders have matching builds
    127 
    +- [ ] On `${STAGING_SERVER}`, ensure updated:
    128 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-${MULLVAD_BROWSER_VERSION}-${MULLVAD_BROWSER_BUILD_N} && git checkout tbb-${MULLVAD_BROWSER_VERSION}-${MULLVAD_BROWSER_BUILD_N}`
    129 
    +  - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    130 
    +    - `ssh_host_builder`: ssh hostname of machine with unsigned builds
    131 
    +    - `ssh_host_linux_signer`: ssh hostname of linux signing machine
    132 
    +    - `builder_tor_browser_build_dir`: path on `ssh_host_builder` to root of builder's `tor-browser-build` clone containing unsigned builds
    115 133 
       - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    116 
    -    - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    134 
    +    - `appstoreconnect_api_key_path`: path to json file containing appstoreconnect api key infos
    117 135 
       - [ ] `set-config.update-responses`
    118 
    -    - `update_responses_repository_dir` : directory where you cloned `git@gitlab.torproject.org:tpo/applications/mullvad-browser-update-responses.git`
    136 
    +    - `update_responses_repository_dir`: directory where you cloned `git@gitlab.torproject.org:tpo/applications/mullvad-browser-update-responses.git`
    119 137 
       - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    120 
    -    - `tbb_version` : mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    121 
    -    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    122 
    -    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    123 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    124 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    125 
    -  - `cd tor-browser-build/tools/signing/`
    126 
    -  - `./do-all-signing.mullvadbrowser`
    127 
    -- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    128 
    -- [ ] Update `staticiforme.torproject.org`:
    129 
    -  - From `screen` session on `staticiforme.torproject.org`:
    130 
    -  - [ ] Remove old release data from `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    131 
    -  - [ ] Static update components (again) : `static-update-component dist.torproject.org`
    138 
    +    - `tbb_version`: mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    139 
    +    - `tbb_version_build`: the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    140 
    +    - `tbb_version_type`: either `alpha` for alpha releases or `release` for stable releases
    141 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    142 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, run do-all-signing script:
    143 
    +  - [ ] Run:
    144 
    +    ```
    145 
    +    cd tor-browser-build/tools/signing/ && ./do-all-signing.mullvadbrowser
    146 
    +    ```
    147 
    +  - **NOTE**: on successful execution, the signed binaries and mars should have been copied to `staticiforme` and update responses pushed
    132 148
    133 149 
     </details>
    134 150
    135 151 
     <details>
    136 152 
       <summary>Publishing</summary>
    137 153
    154 
    +### website
    155 
    +- [ ] On `staticiforme.torproject.org`, remove old release and publish new:
    156 
    +  - [ ] `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    157 
    +  - [ ] Run:
    158 
    +    ```
    159 
    +    static-update-component dist.torproject.org
    160 
    +    ```
    161 
    +
    138 162 
     ### mullvad-browser (GitHub): https://github.com/mullvad/mullvad-browser/
    139 163 
     - [ ] Assign this issue to someone with mullvad commit access, one of:
    140 164 
         - boklm
    141 165 
         - ma1
    142 166 
         - morgan
    143 167 
         - pierov
    168 
    +- [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    169 
    +  - **Tag**: `${MULLVAD_BROWSER_VERSION}`
    170 
    +    - **example**: `12.5a7`
    171 
    +  - **Message**: `${ESR_VERSION}esr-based ${MULLVAD_BROWSER_VERSION}`
    172 
    +    - **example**: `102.12.0esr-based 12.5a7`
    144 173 
     - [ ] Push this release's associated `mullvad-browser.git` branch to github
    145 174 
     - [ ] Push this release's associated tags to github:
    146 175 
       - [ ] Firefox ESR tag
    147 
    -    - **example** : `FIREFOX_102_12_0esr_BUILD1`
    176 
    +    - **example**: `FIREFOX_102_12_0esr_BUILD1`
    148 177 
       - [ ] `base-browser` tag
    149 
    -    - **example** : `base-browser-102.12.0esr-12.0-1-build1`
    150 
    -  - [ ] `mullvad-browser` tag
    151 
    -    - **example** : `mullvad-browser-102.12.0esr-12.0-1-build1`
    152 
    -- [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    153 
    -  - **Tag**: `$(MULLVAD_BROWSER_VERSION)`
    154 
    -    - **example** : `12.0.7`
    155 
    -  - **Message**: `$(ESR_VERSION)esr-based $(MULLVAD_BROWSER_VERSION)`
    156 
    -    - **example** : `102.12.0esr-based 12.0.7`
    157 
    -  - [ ] Push tag to github
    158 
    -
    159 
    -### email
    160 
    -- [ ] **(Once branch+tags pushed to GitHub)** Email Mullvad with release information:
    161 
    -  - [ ] support alias: support@mullvadvpn.net
    162 
    -  - [ ] Rui: rui@mullvad.net
    178 
    +    - **example**: `base-browser-102.12.0esr-12.0-1-build1`
    179 
    +  - [ ] `mullvad-browser` build tag
    180 
    +    - **example**: `mullvad-browser-102.12.0esr-12.0-1-build1`
    181 
    +  - [ ] `mullvad-browser` release tag
    182 
    +    - **example**: `12.0.11`
    183 
    +
    184 
    +
    185 
    +### Mullvad
    186 
    +- [ ] Email Mullvad with release information:
    187 
    +  - **Recipients**
    188 
    +    - Mullvad support alias: support@mullvadvpn.net
    189 
    +    - Rui Hildt: rui@mullvad.net
    190 
    +    ```
    191 
    +    support@mullvadvpn.net rui@mullvad.net
    192 
    +    ```
    163 193 
       - **Subject**
    164 194 
         ```
    165 
    -    New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    195 
    +    New build: Mullvad Browser ${MULLVAD_BROWSER_VERION} (signed)
    166 196 
         ```
    167 197 
       - **Body**
    168 198 
         ```
    ... ... @@ -170,27 +200,31 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    170 200
    171 201 
         Branch+Tags have been pushed to Mullvad's GitHub repo.
    172 202
    173 
    -    - signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    174 
    -    - update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    203 
    +    - signed builds: https://dist.torproject.org/mullvadbrowser/${MULLVAD_BROWSER_VERSION}
    204 
    +    - update_response hashes: ${MULLVAD_UPDATE_RESPONSES_HASH}
    175 205
    176 206 
         changelog:
    207 
    +    # paste changelog as quote here
    177 208 
         ...
    178 209 
         ```
    179 210
    180 211 
     </details>
    181 212
    182 213 
     <details>
    183 
    -  <summary>Downstream</summary>
    184 
    -
    185 
    -### notify packagers
    186 
    -These steps depend on Mullvad having updated their [GitHub Releases](https://github.com/mullvad/mullvad-browser/releases/) page with the latest release
    187 
    -- [ ] Email downstream consumers:
    188 
    -  - [ ] flathub package maintainer: proletarius101@protonmail.com
    189 
    -  - [ ] arch package maintainer: bootctl@gmail.com
    190 
    -  - [ ] nixOS package maintainer: dev@felschr.com
    214 
    +  <summary>Packaging</summary>
    215 
    +
    216 
    +### packagers
    217 
    +- [ ] **(Once Packages are pushed to GitHub)**
    218 
    +  - **Recipients**
    219 
    +    - flathub package maintainer: proletarius101@protonmail.com
    220 
    +    - arch package maintainer: bootctl@gmail.com
    221 
    +    - nixOS package maintainer: dev@felschr.com
    222 
    +    ```
    223 
    +    proletarius101@protonmail.com bootctl@gmail.com dev@felschr.com
    224 
    +    ```
    191 225 
       - **Subject**
    192 226 
         ```
    193 
    -    Mullvad Browser $(MULLVAD_BROWSER_VERSION) released
    227 
    +    Mullvad Browser ${MULLVAD_BROWSER_VERSION} released
    194 228 
         ```
    195 229 
       - **Body**
    196 230 
         ```
    ... ... @@ -204,11 +238,12 @@ These steps depend on Mullvad having updated their [GitHub Releases](https://git
    204 238 
         ```
    205 239
    206 240 
     ### merge requests
    207 
    -- [ ] homebrew: https://github.com/Homebrew/homebrew-cask/blob/master/Casks/m/mullvad-browser.rb
    208 
    -  - **NOTE**: should just need to update `version` and `sha256` to latest
    241 
    +- [ ] **(Once Packages are pushed to GitHub)**
    242 
    +  - [ ] homebrew: https://github.com/Homebrew/homebrew-cask/blob/master/Casks/m/mullvad-browser.rb
    243 
    +    - **NOTE**: a bot seems to pick this up without needing our intervention these days
    244 
    +    - **NOTE**: should just need to update `version` and `sha256` to latest
    209 245
    210 246 
     </details>
    211 247
    212 248 
     /label ~"Release Prep"
    213 
    -/label  ~"Sponsor 131"
    214 
    -
    249 
    +/label ~"Sponsor 131"

  • .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md
    1 
    +- **NOTE** It is assumed the `tor-browser` alpha rebase and security backport tasks have been completed
    2 
    +- **NOTE** This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue
    3 
    +
    1 4 
     <details>
    2 5 
       <summary>Explanation of variables</summary>
    3 6
    4 
    -- `$(BUILD_SERVER)` : the server the main builder is using to build a tor-browser release
    5 
    -- `$(BUILDER)` : whomever is building the release on the $(BUILD_SERVER)
    6 
    -  - **example** : `pierov`
    7 
    -- `$(STAGING_SERVER)` : the server the signer is using to to run the signing process
    8 
    -- `$(ESR_VERSION)` : the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc
    9 
    -  - **example** : `91.6.0`
    10 
    -- `$(TOR_BROWSER_MAJOR)` : the Tor Browser major version
    11 
    -  - **example** : `11`
    12 
    -- `$(TOR_BROWSER_MINOR)` : the Tor Browser minor version
    13 
    -  - **example** : either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    14 
    -- `$(TOR_BROWSER_VERSION)` : the Tor Browser version in the format
    15 
    -  - **example** : `12.5a3`, `12.0.3`
    16 
    -- `$(BUILD_N)` : a project's build revision within a its branch; this is separate from the `$(TOR_BROWSER_BUILD_N)` value; many of the Firefox-related projects have a `$(BUILD_N)` suffix and may differ between projects even when they contribute to the same build.
    17 
    -  - **example** : `build1`
    18 
    -- `$(TOR_BROWSER_BUILD_N)` : the tor-browser build revision for a given Tor Browser release; used in tagging git commits
    19 
    -  - **example** : `build2`
    20 
    -  - **NOTE** : A project's `$(BUILD_N)` and `$(TOR_BROWSER_BUILD_N)` may be the same, but it is possible for them to diverge. For example :
    21 
    -    - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the `$(BUILD_N)` value will increase, while the `$(TOR_BROWSER_BUILD_N)` value may stay at `build1` (but the `$(TOR_BROWSER_VERSION)` will increase)
    22 
    -    - if we have build failures unrelated to `tor-browser`, the `$(TOR_BROWSER_BUILD_N)` value will increase while the `$(BUILD_N)` will stay the same.
    23 
    -- `$(TOR_BROWSER_VERSION)` : the published Tor Browser version
    24 
    -    - **example** : `11.5a6`, `11.0.7`
    25 
    -- `$(TBB_BUILD_TAG)` : the `tor-browser-build` build tag used to build a given Tor Browser version
    26 
    -    - **example** : `tbb-12.5a7-build1`
    27 
    -</details>
    7 
    +- `${BUILD_SERVER}`: the server the main builder is using to build a browser release
    8 
    +- `${BUILDER}`: whomever is building the release on the ${BUILD_SERVER}
    9 
    +  - **example**: `pierov`
    10 
    +- `${STAGING_SERVER}`: the server the signer is using to to run the signing process
    11 
    +- `${ESR_VERSION}`: the Mozilla defined ESR version, used in various places for building browser tags, labels, etc
    12 
    +  - **example**: `91.6.0`
    13 
    +- `${TOR_BROWSER_MAJOR}`: the Tor Browser major version
    14 
    +  - **example**: `11`
    15 
    +- `${TOR_BROWSER_MINOR}`: the Tor Browser minor version
    16 
    +  - **example**: either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    17 
    +- `${TOR_BROWSER_VERSION}`: the Tor Browser version in the format
    18 
    +  - **example**: `12.5a3`, `12.0.3`
    19 
    +- `${BUILD_N}`: a project's build revision within a its branch; this is separate from the `${TOR_BROWSER_BUILD_N}` value; many of the Firefox-related projects have a `${BUILD_N}` suffix and may differ between projects even when they contribute to the same build.
    20 
    +  - **example**: `build1`
    21 
    +- `${TOR_BROWSER_BUILD_N}`: the tor-browser build revision for a given Tor Browser release; used in tagging git commits
    22 
    +  - **example**: `build2`
    23 
    +  - **⚠️ WARNING**: A project's `${BUILD_N}` and `${TOR_BROWSER_BUILD_N}` may be the same, but it is possible for them to diverge. For example :
    24 
    +    - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the `${BUILD_N}` value will increase, while the `${TOR_BROWSER_BUILD_N}` value may stay at `build1` (but the `${TOR_BROWSER_VERSION}` will increase)
    25 
    +    - if we have build failures unrelated to `tor-browser`, the `${TOR_BROWSER_BUILD_N}` value will increase while the `${BUILD_N}` will stay the same.
    26 
    +- `${TOR_BROWSER_VERSION}`: the published Tor Browser version
    27 
    +    - **example**: `11.5a6`, `11.0.7`
    28 
    +- `${TBB_BUILD_TAG}`: the `tor-browser-build` build tag used to build a given Tor Browser version
    29 
    +  - **example**: `tbb-12.5a7-build1`
    30 
    +- `${RELEASE_DATE}`: the intended release date of this browser release; for ESR schedule-driven releases, this should match the upstream Firefox release date
    31 
    +  - **example**: `2024-10-29`
    28 32
    29 
    -**NOTE** It is assumed that the `tor-browser` stable rebase and security backport tasks have been completed
    30 
    -**NOTE** This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue
    33 
    +</details>
    31 34
    32 35 
     <details>
    33 
    -  <summary>Building</summary>
    36 
    +  <summary>Build Configuration</summary>
    34 37
    35 38 
     ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    36 39 
     Tor Browser Alpha (and Nightly) are on the `main` branch
    37 40
    38 
    -- [ ] Update `rbm.conf`
    39 
    -  - [ ] `var/torbrowser_version` : update to next version
    40 
    -  - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)`
    41 
    -  - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building.
    42 
    -  - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from` : update to previous Desktop version
    43 
    -    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    44 
    -    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    45 
    -- [ ] Update Desktop-specific build configs
    46 
    -  - [ ] Update `projects/firefox/config`
    47 
    -    - [ ] `browser_build` : update to match `tor-browser` tag
    48 
    -    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    49 
    -- [ ] Update Android-specific build configs
    50 
    -  - [ ] Update `projects/geckoview/config`
    51 
    -    - [ ] `browser_build` : update to match `tor-browser` tag
    52 
    -    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    53 
    -  - [ ] ***(Optional)*** Update `projects/application-services/config`:
    54 
    -    **NOTE** we don't currently have any of our own patches for this project
    55 
    -    - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)`
    56 
    -- [ ] Update `projects/translation/config`:
    57 
    -  - [ ] run `make list_translation_updates-alpha` to get updated hashes
    58 
    -  - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    59 
    -  - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    60 
    -  - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    61 
    -- [ ] Update common build configs
    62 
    -  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    63 
    -    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    64 
    -      - [ ] `URL`
    65 
    -      - [ ] `sha256sum`
    66 
    -  - [ ] Check for OpenSSL updates here : https://www.openssl.org/source/
    67 
    -    - [ ] ***(Optional)*** If new 3.0.X version available, update `projects/openssl/config`
    68 
    -      - [ ] `version` : update to next 3.0.X version
    69 
    -      - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball
    70 
    -  - [ ] Check for zlib updates here: https://github.com/madler/zlib/releases
    71 
    -    - [ ] **(Optional)** If new tag available, update `projects/zlib/config`
    72 
    -      - [ ] `version` : update to next release tag
    73 
    -  - [ ] Check for Zstandard updates here: https://github.com/facebook/zstd/releases
    74 
    -    - [ ] **(Optional)** If new tag available, update `projects/zstd/config`
    75 
    -      - [ ] `version` : update to next release tag
    76 
    -      - [ ] `git_hash`: update to the commit corresponding to the tag (we don't check signatures for Zstandard)
    77 
    -  - [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags
    78 
    -    - [ ] ***(Optional)*** Update `projects/tor/config`
    79 
    -      - [ ] `version` : update to latest `-alpha` tag or release tag if newer (ping dgoulet or ahf if unsure)
    80 
    -  - [ ] Check for go updates here : https://go.dev/dl
    81 
    -    - **NOTE** : In general, Tor Browser Alpha uses the latest Stable major series Go version, but there are sometimes exceptions. Check with the anti-censorship team before doing a major version update in case there is incompatibilities.
    82 
    -    - [ ] ***(Optional)*** Update `projects/go/config`
    83 
    -      - [ ] `version` : update go version
    84 
    -      - [ ] `input_files/sha256sum` for `go` : update sha256sum of archive (sha256 sums are displayed on the go download page)
    85 
    -  - [ ] Check for manual updates by running (from `tor-browser-build` root): `./tools/update_manual.py`
    86 
    -    - [ ] ***(Optional)*** If new version is available:
    87 
    -      - [ ] Upload the downloaded `manual_$PIPELINEID.zip` file to `tb-build-02.torproject.org`
    88 
    -        - The script will tell if it's necessary to
    89 
    -      - [ ] Deploy to `tb-builder`'s `public_html` directory:
    90 
    -        - `sudo -u tb-builder cp manual_$PIPELINEID.zip ~tb-builder/public_html/.`
    91 
    -      - [ ] Add `projects/manual/config` to the stage area if the script updated it.
    92 
    -- [ ] Update `ChangeLog-TBB.txt`
    93 
    -  - [ ] Ensure `ChangeLog-TBB.txt` is sync'd between alpha and stable branches
    94 
    -  - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    95 
    -  - [ ] Run `./tools/fetch_changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    96 
    -    - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    97 
    -    - The first time you run this script you will need to generate an access token; the script will guide you
    98 
    -    - `$updateArgs` should be these arguments, depending on what you actually updated:
    99 
    -      - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    100 
    -      - [ ] `--tor`
    101 
    -      - [ ] `--no-script`
    102 
    -      - [ ] `--openssl`
    103 
    -      - [ ] `--zlib`
    104 
    -      - [ ] `--zstd`
    105 
    -      - [ ] `--go`
    106 
    -      - E.g., `./tools/fetch_changelogs.py 41028 --date 'December 19 2023' --firefox 115.6.0esr --tor 0.4.8.10 --no-script 11.4.29 --zlib 1.3 --go 1.21.5 --openssl 3.0.12`
    107 
    -    - `--date $date` is optional, if omitted it will be the date on which you run the command
    108 
    -  - [ ] Copy the output of the script to the beginning of `ChangeLog-TBB.txt` and adjust its output
    41 
    +- [ ] Tag `tor-browser` in tor-browser.git
    42 
    +  - **example**: `tor-browser-128.3.0esr-14.0-1-build1`
    43 
    +- [ ] Changelog bookkeeping:
    44 
    +  - [ ] Ensure all commits to `tor-browser` and `tor-browser-build` for this release have an associated issue linked to this release preparation issue
    45 
    +  - [ ] Ensure each issue has a platform (~Windows, ~MacOS, ~Linux, ~Android, ~Desktop, ~"All Platforms") and potentially ~"Build System" labels
    46 
    +- [ ] Create a release preparation branch from the `main` branch
    47 
    +- [ ] Run release preparation script:
    48 
    +  - **NOTE**: You can omit the `--tor-browser` argument if this is for a jointt Tor and Mullvad Browser release
    49 
    +  ```bash
    50 
    +  ./tools/relprep.py --tor-browser --date ${RELEASE_DATE} ${TOR_BROWSER_VERSION}
    51 
    +  ```
    52 
    +  - **⚠️ WARNING**: You may need to manually update the `firefox/config` and `geckoview/config` files' `browser_build` field if `tor-browser.git` has not yet been tagged (e.g. if security backports have not yet been merged and tagged)
    53 
    +- [ ] Review build configuration changes:
    54 
    +  - [ ] `rbm.conf`
    55 
    +    - [ ] `var/torbrowser_version`: updated to next browser version
    56 
    +    - [ ] `var/torbrowser_build`: updated to `${TOR_BROWSER_BUILD_N}`
    57 
    +    - [ ] `var/browser_release_date`: updated to build date. For the build to be reproducible, the date should be in the past when building.
    58 
    +      - **⚠️ WARNING**: If we have updated `var/torbrowser_build` without updating the `firefox` or `geckoview` tags, then we can leave this unchanged to avoid forcing a firefox re-build (e.g. when bumping `var/torbrwoser_build` to build2, build3, etc due to non-firefox related build issues)
    59 
    +    - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from`: updated to previous Desktop version
    60 
    +      - **NOTE**: We try to build incrementals for the previous 3 desktop versions
    61 
    +      - **⚠️ WARNING**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    62 
    +  - [ ] `projects/firefox/config`
    63 
    +    - [ ] `browser_build`: updated to match `tor-browser` tag
    64 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
    65 
    +  - [ ] `projects/geckoview/config`
    66 
    +    - [ ] `browser_build`: updated to match `tor-browser` tag
    67 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
    68 
    +  - [ ] ***(Optional)*** `projects/translation/config`:
    69 
    +    - [ ] `steps/base-browser/git_hash`: updated with `HEAD` commit of project's `base-browser` branch
    70 
    +    - [ ] `steps/tor-browser/git_hash`: updated with `HEAD` commit of project's `tor-browser` branch
    71 
    +    - [ ] `steps/fenix/git_hash`: updated with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    72 
    +  - [ ] ***(Optional)*** `projects/browser/config`:
    73 
    +    - [ ] NoScript: https://addons.mozilla.org/en-US/firefox/addon/noscript
    74 
    +      - [ ] `URL` updated
    75 
    +        - **⚠️ WARNING**: If preparing the release manually, updating the version number in the url is not sufficient, as each version has a random unique id in the download url
    76 
    +      - [ ] `sha256sum` updated
    77 
    +  - [ ] ***(Optional)*** `projects/openssl/config`: https://www.openssl.org/source/
    78 
    +    - **NOTE**: Only if new LTS version (3.0.X currrently) available
    79 
    +    - [ ] `version`: updated to next LTS version
    80 
    +    - [ ] `input_files/sha256sum`: updated to sha256 sum of source tarball
    81 
    +  - [ ] **(Optional)** `projects/zlib/config`: https://github.com/madler/zlib/releases
    82 
    +    - **NOTE**: Only if new tag available
    83 
    +    - [ ] `version`: updated to next release tag
    84 
    +  - [ ] **(Optional)** `projects/zstd/config`: https://github.com/facebook/zstd/releases
    85 
    +    - **NOTE**: Only if new tag available; Android-only for now
    86 
    +    - [ ] `version`: updated to next release tag
    87 
    +    - [ ] `git_hash`: updated to the commit corresponding to the tag (we don't check signatures for Zstandard)
    88 
    +  - [ ] **(Optional)** `projects/tor/config` https://gitlab.torproject.org/tpo/core/tor/-/tags
    89 
    +    - [ ] `version`: updated to latest `-alpha` tag or release tag if newer (ping **dgoulet** or **ahf** if unsure)
    90 
    +  - [ ] **(Optional)** `projects/go/config` https://go.dev/dl
    91 
    +    - **NOTE**: In general, Tor Browser Alpha uses the latest Stable major series Go version, but there are sometimes exceptions. Check with the anti-censorship team before doing a major version update in case there is incompatibilities.
    92 
    +    - [ ] `version`: updated go version
    93 
    +    - [ ] `input_files/sha256sum` for `go`: update sha256sum of archive (sha256 sums are displayed on the go download page)
    94 
    +  - [ ] **(Optional)** `projects/manual/config`
    95 
    +    - [ ] `version`: updated to latest pipeline id
    96 
    +    - [ ] `input_files/shasum` for `manual`: updated to manual hash
    97 
    +    - [ ] Upload the downloaded `manual_${PIPELINEID}.zip` file to `tb-build-02.torproject.org`
    98 
    +    - [ ] Deploy to `tb-builder`'s `public_html` directory:
    99 
    +      - [ ] Run:
    100 
    +        ```
    101 
    +        sudo -u tb-builder cp manual_${PIPELINEID}.zip ~tb-builder/public_html/.
    102 
    +        ```
    103 
    +      - [`sudo` documentation for TPO machines](https://gitlab.torproject.org/tpo/tpa/team/-/wikis/doc/accounts#changingresetting-your-passwords)
    104 
    +  - [ ] `ChangeLog-TBB.txt`: ensure correctness
    105 
    +    - [ ] Browser name correct
    106 
    +    - [ ] Release date correct
    107 
    +    - [ ] No Android updates on a desktop-only release and vice-versa
    108 
    +    - [ ] All issues added under correct platform
    109 
    +    - [ ] ESR updates correct
    110 
    +    - [ ] Component updates correct
    109 111 
     - [ ] Open MR with above changes, using the template for release preparations
    110 112 
     - [ ] Merge
    111 113 
     - [ ] Sign+Tag
    ... ... @@ -115,55 +117,52 @@ Tor Browser Alpha (and Nightly) are on the `main` branch
    115 117 
         - ma1
    116 118 
         - morgan
    117 119 
         - pierov
    118 
    -  - [ ] Run: `make torbrowser-signtag-alpha`
    120 
    +  - [ ] Run:
    121 
    +    ```
    122 
    +    make torbrowser-signtag-alpha
    123 
    +    ```
    119 124 
       - [ ] Push tag to `upstream`
    120 125 
     - [ ] Build the tag:
    121 
    -  - Run `make torbrowser-alpha && make torbrowser-incrementals-alpha`
    126 
    +  - [ ] Run:
    127 
    +    ```
    128 
    +    make torbrowser-alpha && make torbrowser-incrementals-alpha
    129 
    +    ```
    122 130 
         - [ ] Tor Project build machine
    123 131 
         - [ ] Local developer machine
    124 132 
       - [ ] Submit build request to Mullvad infrastructure:
    125 133 
         - **NOTE** this requires a devmole authentication token
    126 
    -    - Run `make torbrowser-kick-devmole-build`
    127 
    -- [ ] Ensure builders have matching builds
    134 
    +    - [ ] Run:
    135 
    +      ```
    136 
    +      make torbrowser-kick-devmole-build
    137 
    +      ```
    128 138
    129 139 
     </details>
    130 140
    131 141 
     <details>
    132 
    -  <summary>Communications</summary>
    133 
    -
    134 
    -### notify stakeholders
    135 
    -- [ ] **(Once builds confirmed matching)** Email tor-qa mailing list with release information
    136 
    -  - [ ] tor-qa: tor-qa@lists.torproject.org
    137 
    -  - **Subject**
    138 
    -    ```
    139 
    -    Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    140 
    -    ```
    141 
    -  - **Body**
    142 
    -    ```
    143 
    -    Hello,
    144 
    -
    145 
    -    Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing:
    146 
    -
    147 
    -    - https://tb-build-02.torproject.org/~$(BUILDER)/builds/torbrowser/alpha/unsigned/$(TOR_BROWSER_VERSION)/
    148 
    -
    149 
    -    The full changelog can be found here:
    150 
    -
    151 
    -    - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
    152 
    -    ```
    153 
    -- [ ] ***(Optional, only around build/packaging changes)*** Email packagers:
    154 
    -  - [ ] Tails dev mailing list: tails-dev@boum.org
    155 
    -  - [ ] Guardian Project: nathan@guardianproject.info
    156 
    -  - [ ] FreeBSD port: freebsd@sysctl.cz <!-- Gitlab user maxfx -->
    157 
    -  - [ ] OpenBSD port: caspar@schutijser.com <!-- Gitlab user cschutijser -->
    158 
    -  - [ ] Anti-Censorship: meskio@torproject.org
    159 
    -  - [ ] Note any changes which may affect packaging/downstream integration
    160 
    -- [ ] ***(Optional, only after internal API-breaking changes)*** Email downstream project maintainers:
    161 
    -  - [ ] selenium-tor: matzfan@tempr.email <!-- Forum user Noino -->
    162 
    -- [ ] ***(Optional, after ESR migration)*** Email external partners:
    163 
    -  - [ ] Cloudflare: ask-research@cloudflare.com
    164 
    -    - **NOTE** :  We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs
    165 
    -  - [ ]  Startpage: admin@startpage.com
    166 
    -    - **NOTE** : Startpage also needs the updated user-agent string for better experience on their onion service sites.
    142 
    +  <summary>Website</summary>
    143 
    +
    144 
    +  ### downloads: https://gitlab.torproject.org/tpo/web/tpo.git
    145 
    +  - [ ] `databags/versions.ini`: Update the downloads versions
    146 
    +      - `torbrowser-stable/version`: catch-all for latest stable version
    147 
    +      - `torbrowser-alpha/version`: catch-all for latest alpha version
    148 
    +      - `torbrowser-legacy/version`: catch-all for latest ESR-115 version
    149 
    +      - `torbrowser-*-stable/version`: platform-specific stable versions
    150 
    +      - `torbrowser-*-alpha/version`: platform-specific alpha versions
    151 
    +      - `torbrowser-*-legacy/version`: platform-specific legacy versions
    152 
    +  - [ ] Push to origin as new branch and create MR
    153 
    +  - [ ] Review
    154 
    +  - [ ] Merge
    155 
    +    - **⚠️ WARNING**: Do not deploy yet!
    156 
    +
    157 
    +  ### blog: https://gitlab.torproject.org/tpo/web/blog.git
    158 
    +  - [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    159 
    +    - [ ] Note any ESR update
    160 
    +    - [ ] Thank any users which have contributed patches
    161 
    +    - [ ] **(Optional)** Draft any additional sections for new features which need testing, known issues, etc
    162 
    +  - [ ] Push to origin as new branch and open MR
    163 
    +  - [ ] Review
    164 
    +  - [ ] Merge
    165 
    +    - **⚠️ WARNING**: Do not deploy yet!
    167 166
    168 167 
     </details>
    169 168
    ... ... @@ -171,38 +170,33 @@ Tor Browser Alpha (and Nightly) are on the `main` branch
    171 170 
       <summary>Signing</summary>
    172 171
    173 172 
     ### release signing
    174 
    -- **NOTE** : In practice, it's most efficient to have the blog post and website updates ready to merge, since signing doesn't take very long
    175 173 
     - [ ] Assign this issue to the signer, one of:
    176 174 
       - boklm
    175 
    +  - ma1
    177 176 
       - morgan
    178 
    -- [ ] On `$(STAGING_SERVER)`, ensure updated:
    179 
    -  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N) && git checkout tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N)`
    177 
    +  - pierov
    178 
    +- [ ] Ensure all builders have matching builds
    179 
    +- [ ] On `${STAGING_SERVER}`, ensure updated:
    180 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N} && git checkout tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N}`
    180 181 
       - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    181 
    -    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    182 
    -      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    183 
    -    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    182 
    +    - `ssh_host_builder`: ssh hostname of machine with unsigned builds
    183 
    +    - `ssh_host_linux_signer`: ssh hostname of linux signing machine
    184 
    +    - `builder_tor_browser_build_dir`: path on `ssh_host_builder` to root of builder's `tor-browser-build` clone containing unsigned builds
    184 185 
       - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    185 
    -    - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    186 
    +    - `appstoreconnect_api_key_path`: path to json file containing appstoreconnect api key infos
    186 187 
       - [ ] `set-config.update-responses`
    187 
    -    - `update_responses_repository_dir` : directory where you cloned `git@gitlab.torproject.org:tpo/applications/tor-browser-update-responses.git`
    188 
    +    - `update_responses_repository_dir`: directory where you cloned `git@gitlab.torproject.org:tpo/applications/tor-browser-update-responses.git`
    188 189 
       - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    189 
    -    - `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    190 
    -    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    191 
    -    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    192 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    193 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    194 
    -  - `cd tor-browser-build/tools/signing/`
    195 
    -  - `./do-all-signing.torbrowser`
    196 
    -- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    197 
    -- [ ] Update `staticiforme.torproject.org`:
    198 
    -  - From `screen` session on `staticiforme.torproject.org`:
    199 
    -  - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    200 
    -  - [ ] Enable update responses : `sudo -u tb-release ./deploy_update_responses-alpha.sh`
    201 
    -  - [ ] Remove old release data from following places:
    202 
    -    - **NOTE** : Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    203 
    -    - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    204 
    -    - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    205 
    -  - [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    190 
    +    - `tbb_version`: tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    191 
    +    - `tbb_version_build`: the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    192 
    +    - `tbb_version_type`: either `alpha` for alpha releases or `release` for stable releases
    193 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    194 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, run do-all-signing script:
    195 
    +  - [ ] Run:
    196 
    +    ```
    197 
    +    cd tor-browser-build/tools/signing/ && ./do-all-signing.torbrowser
    198 
    +    ```
    199 
    +  - **NOTE**: on successful execution, the signed binaries and mars should have been copied to `staticiforme` and update responses pushed
    206 200
    207 201 
     </details>
    208 202
    ... ... @@ -242,6 +236,26 @@ popd
    242 236 
     <details>
    243 237 
       <summary>Publishing</summary>
    244 238
    239 
    +### website
    240 
    +- [ ] On `staticiforme.torproject.org`, static update components:
    241 
    +  ```
    242 
    +  static-update-component cdn.torproject.org && static-update-component dist.torproject.org
    243 
    +  ```
    244 
    +- [ ] Deploy `tor-website` MR
    245 
    +- [ ] Deploy `tor-blog` MR
    246 
    +- [ ] On `staticiforme.torproject.org`, enable update responses:
    247 
    +  ```
    248 
    +  sudo -u tb-release ./deploy_update_responses-alpha.sh
    249 
    +  ```
    250 
    +- [ ] On `staticiforme.torproject.org`, remove old release:
    251 
    +  - **NOTE**: Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    252 
    +  - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    253 
    +  - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    254 
    +  - [ ] Run:
    255 
    +    ```
    256 
    +    static-update-component cdn.torproject.org && static-update-component dist.torproject.org
    257 
    +    ```
    258 
    +
    245 259 
     ### Google Play: https://play.google.com/apps/publish
    246 260 
     - [ ] Publish APKs to Google Play:
    247 261 
       - Select `Tor Browser (Alpha)` app
    ... ... @@ -256,46 +270,70 @@ popd
    256 270 
         - [ ] 100% rollout when publishing a security-driven release
    257 271 
       - [ ] Update rollout percentage to 100% after confirmed no major issues
    258 272
    259 
    -### website: https://gitlab.torproject.org/tpo/web/tpo.git
    260 
    -- [ ] `databags/versions.ini` : Update the downloads versions
    261 
    -    - `torbrowser-stable/version` : sort of a catch-all for latest stable version
    262 
    -    - `torbrowser-alpha/version` : sort of a catch-all for latest stable version
    263 
    -    - `torbrowser-*-stable/version` : platform-specific stable versions
    264 
    -    - `torbrowser-*-alpha/version` : platform-specific alpha versions
    265 
    -    - `tor-stable`,`tor-alpha` : set by tor devs, do not touch
    266 
    -- [ ] Push to origin as new branch, open 'Draft :' MR
    267 
    -- [ ] Remove `Draft:` from MR once signed-packages are accessible on https://dist.torproject.org
    268 
    -- [ ] Merge
    269 
    -- [ ] Publish after CI passes and builds are published
    270 
    -
    271 
    -### blog: https://gitlab.torproject.org/tpo/web/blog.git
    272 
    -- [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    273 
    -  - [ ] Note any ESR update
    274 
    -  - [ ] Note any updates to dependencies (OpenSSL, zlib, NoScript, tor, etc)
    275 
    -  - [ ] Thank any users which have contributed patches
    276 
    -  - [ ] **(Optional)** Draft any additional sections for new features which need testing, known issues, etc
    277 
    -- [ ] Push to origin as new branch, open `Draft:` MR
    278 
    -- [ ] Merge once signed-packages are accessible on https://dist.torproject.org
    279 
    -- [ ] Publish after CI passes and website has been updated
    273 
    +</details>
    274 
    +
    275 
    +<details>
    276 
    +  <summary>Communications</summary>
    280 277
    281 278 
     ### tor-announce mailing list
    282 
    -- [ ] Email tor-announce mailing list: tor-announce@lists.torproject.org
    279 
    +- [ ] Email tor-announce mailing list
    280 
    +  - **Recipients**
    281 
    +    ```
    282 
    +    tor-announce@lists.torproject.org
    283 
    +    ```
    283 284 
       - **Subject**
    284 285 
         ```
    285 
    -    New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    286 
    +    New Release: Tor Browser ${TOR_BROWSER_VERSION} (Android, Windows, macOS, Linux)
    286 287 
         ```
    287 288 
       - **Body**
    288 289 
         ```
    289 290 
         Hi everyone,
    290 291
    291 
    -    Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    292 
    -    - $(BLOG_POST_URL)
    292 
    +    Tor Browser ${TOR_BROWSER_VERSION} has now been published for all platforms. For details please see our blog post:
    293 
    +    - ${BLOG_POST_URL}
    293 294
    294 295 
         Changelog:
    295 
    -    # paste changleog as quote here
    296 
    +    # paste changelog as quote here
    297 
    +    ```
    298 
    +
    299 
    +### packagers
    300 
    +- [ ] ***(Optional, only around build/packaging changes)*** Email packagers:
    301 
    +  - **Recipients**
    302 
    +    - Tails dev mailing list: tails-dev@boum.org
    303 
    +    - Guardian Project: nathan@guardianproject.info
    304 
    +    - FreeBSD port: freebsd@sysctl.cz <!-- Gitlab user maxfx -->
    305 
    +    - OpenBSD port: caspar@schutijser.com <!-- Gitlab user cschutijser -->
    306 
    +    - torbrowser-launcher: mail@asciiwolf.com <!-- Gitlab user asciiwolf -->
    307 
    +    - Anti-Censorship: meskio@torproject.org <!-- Gitlab user meskio -->
    308 
    +    ```
    309 
    +    tails-dev@boum.org nathan@guardianproject.info freebsd@sysctl.cz caspar@schutijser.com mail@asciiwolf.com meskio@torproject.org
    310 
    +    ```
    311 
    +  - **Subject**
    296 312 
         ```
    313 
    +    New Release: Tor Browser ${TOR_BROWSER_VERSION} (Android, Windows, macOS, Linux)
    314 
    +    ```
    315 
    +  - [ ] Note any changes which may affect packaging/downstream integration
    316 
    +
    317 
    +### downstream projects
    318 
    +- [ ] ***(Optional, only after internal API-breaking changes)*** Email downstream project maintainers:
    319 
    +  - **Recipients**
    320 
    +    - selenium-tor: matzfan@tempr.email <!-- Forum user Noino -->
    321 
    +    ```
    322 
    +    matzfan@tempr.email
    323 
    +    ```
    324 
    +  - **Subject**
    325 
    +    ```
    326 
    +    Breaking Changes in Tor Browser ${TOR_BROWSER_VERSION}
    327 
    +    ```
    328 
    +  - [ ] Note any internal API changes which may affect browser automation
    329 
    +
    330 
    +### upstream services
    331 
    +- [ ] ***(Optional, after ESR migration)*** Email external partners:
    332 
    +  - [ ] Cloudflare: ask-research@cloudflare.com
    333 
    +    - **NOTE**:  We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs
    334 
    +  - [ ]  Startpage: admin@startpage.com
    335 
    +    - **NOTE**: Startpage also needs the updated user-agent string for better experience on their onion service sites.
    297 336
    298 337 
     </details>
    299 338
    300 339 
     /label ~"Release Prep"
    301 
    -

  • .gitlab/issue_templates/Release Prep - Tor Browser Legacy.md
    1 
    +- **NOTE** It is assumed the `tor-browser` release rebase and security backport tasks have been completed
    2 
    +
    3 
    +<details>
    4 
    +  <summary>Explanation of variables</summary>
    5 
    +
    6 
    +- `${BUILD_SERVER}`: the server the main builder is using to build a browser release
    7 
    +- `${BUILDER}`: whomever is building the release on the ${BUILD_SERVER}
    8 
    +  - **example**: `pierov`
    9 
    +- `${STAGING_SERVER}`: the server the signer is using to to run the signing process
    10 
    +- `${ESR_VERSION}`: the Mozilla defined ESR version, used in various places for building browser tags, labels, etc
    11 
    +  - **example**: `91.6.0`
    12 
    +- `${TOR_BROWSER_MAJOR}`: the Tor Browser major version
    13 
    +  - **example**: `11`
    14 
    +- `${TOR_BROWSER_MINOR}`: the Tor Browser minor version
    15 
    +  - **example**: either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    16 
    +- `${TOR_BROWSER_VERSION}`: the Tor Browser version in the format
    17 
    +  - **example**: `12.5a3`, `12.0.3`
    18 
    +- `${BUILD_N}`: a project's build revision within a its branch; this is separate from the `${TOR_BROWSER_BUILD_N}` value; many of the Firefox-related projects have a `${BUILD_N}` suffix and may differ between projects even when they contribute to the same build.
    19 
    +  - **example**: `build1`
    20 
    +- `${TOR_BROWSER_BUILD_N}`: the tor-browser build revision for a given Tor Browser release; used in tagging git commits
    21 
    +  - **example**: `build2`
    22 
    +  - **⚠️ WARNING**: A project's `${BUILD_N}` and `${TOR_BROWSER_BUILD_N}` may be the same, but it is possible for them to diverge. For example :
    23 
    +    - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the `${BUILD_N}` value will increase, while the `${TOR_BROWSER_BUILD_N}` value may stay at `build1` (but the `${TOR_BROWSER_VERSION}` will increase)
    24 
    +    - if we have build failures unrelated to `tor-browser`, the `${TOR_BROWSER_BUILD_N}` value will increase while the `${BUILD_N}` will stay the same.
    25 
    +- `${TOR_BROWSER_VERSION}`: the published Tor Browser version
    26 
    +    - **example**: `11.5a6`, `11.0.7`
    27 
    +- `${TBB_BUILD_TAG}`: the `tor-browser-build` build tag used to build a given Tor Browser version
    28 
    +  - **example**: `tbb-12.5a7-build1`
    29 
    +- `${RELEASE_DATE}`: the intended release date of this browser release; for ESR schedule-driven releases, this should match the upstream Firefox release date
    30 
    +  - **example**: `2024-10-29`
    31 
    +
    32 
    +</details>
    33 
    +
    34 
    +<details>
    35 
    +  <summary>Build Configuration</summary>
    36 
    +
    37 
    +### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    38 
    +Tor Browser Legacy is on the `maint-13.5` branch
    39 
    +
    40 
    +- [ ] Tag `tor-browser` in tor-browser.git
    41 
    +  - **example**: `tor-browser-115.17.0esr-13.5-1-build1`
    42 
    +- [ ] Changelog bookkeeping:
    43 
    +  - [ ] Ensure all commits to `tor-browser` and `tor-browser-build` for this release have an associated issue linked to this release preparation issue
    44 
    +  - [ ] Ensure each issue has a platform (~Windows, ~MacOS, ~Desktop, ~"All Platforms") and potentially ~"Build System" labels
    45 
    +- [ ] Create a release preparation branch from the `maint-13.5` branch
    46 
    +- [ ] Run release preparation script:
    47 
    +  ```bash
    48 
    +  ./tools/relprep.py --tor-browser --date ${RELEASE_DATE} ${TOR_BROWSER_VERSION}
    49 
    +  ```
    50 
    +  - **⚠️ WARNING**: You may need to manually update the `firefox/config` file's `browser_build` field if `tor-browser.git` has not yet been tagged (e.g. if security backports have not yet been merged and tagged)
    51 
    +- [ ] Review build configuration changes:
    52 
    +  - [ ] `rbm.conf`
    53 
    +    - [ ] `var/torbrowser_version`: updated to next browser version
    54 
    +    - [ ] `var/torbrowser_build`: updated to `${TOR_BROWSER_BUILD_N}`
    55 
    +    - [ ] `var/browser_release_date`: updated to build date. For the build to be reproducible, the date should be in the past when building.
    56 
    +      - **⚠️ WARNING**: If we have updated `var/torbrowser_build` without updating the `firefox`, then we can leave this unchanged to avoid forcing a firefox re-build (e.g. when bumping `var/torbrwoser_build` to build2, build3, etc due to non-firefox related build issues)
    57 
    +    - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from`: updated to previous Desktop version
    58 
    +      - **NOTE**: We try to build incrementals for the previous 3 desktop versions
    59 
    +      - **⚠️ WARNING**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    60 
    +  - [ ] `projects/firefox/config`
    61 
    +    - [ ] `browser_build`: updated to match `tor-browser` tag
    62 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
    63 
    +  - [ ] ***(Optional)*** `projects/translation/config`:
    64 
    +    - [ ] `steps/base-browser/git_hash`: updated with `HEAD` commit of project's `base-browser` branch
    65 
    +    - [ ] `steps/tor-browser/git_hash`: updated with `HEAD` commit of project's `tor-browser` branch
    66 
    +  - [ ] ***(Optional)*** `projects/browser/config`:
    67 
    +    - [ ] NoScript: https://addons.mozilla.org/en-US/firefox/addon/noscript
    68 
    +      - [ ] `URL` updated
    69 
    +        - **⚠️ WARNING**: If preparing the release manually, updating the version number in the url is not sufficient, as each version has a random unique id in the download url
    70 
    +      - [ ] `sha256sum` updated
    71 
    +  - [ ] ***(Optional)*** `projects/openssl/config`: https://www.openssl.org/source/
    72 
    +    - **NOTE**: Only if new LTS version (3.0.X currrently) available
    73 
    +    - [ ] `version`: updated to next LTS version
    74 
    +    - [ ] `input_files/sha256sum`: updated to sha256 sum of source tarball
    75 
    +  - [ ] **(Optional)** `projects/zlib/config`: https://github.com/madler/zlib/releases
    76 
    +    - **NOTE**: Only if new tag available
    77 
    +    - [ ] `version`: updated to next release tag
    78 
    +  - [ ] **(Optional)** `projects/zstd/config`: https://github.com/facebook/zstd/releases
    79 
    +    - **NOTE**: Only if new tag available
    80 
    +    - [ ] `version`: updated to next release tag
    81 
    +    - [ ] `git_hash`: updated to the commit corresponding to the tag (we don't check signatures for Zstandard)
    82 
    +  - [ ] **(Optional)** `projects/tor/config` https://gitlab.torproject.org/tpo/core/tor/-/tags
    83 
    +    - [ ] `version`: updated to latest non `-alpha` tag or release tag if newer (ping **dgoulet** or **ahf** if unsure)
    84 
    +  - [ ] **(Optional)** `projects/go/config` https://go.dev/dl
    85 
    +    - [ ] `go_1_22`: updated to latest 1.22 version
    86 
    +    - [ ] `input_files/sha256sum` for `go`: update sha256sum of archive (sha256 sums are displayed on the go download page)
    87 
    +  - [ ] **(Optional)** `projects/manual/config`
    88 
    +    - [ ] `version`: updated to latest pipeline id
    89 
    +    - [ ] `input_files/shasum` for `manual`: updated to manual hash
    90 
    +    - [ ] Upload the downloaded `manual_${PIPELINEID}.zip` file to `tb-build-02.torproject.org`
    91 
    +    - [ ] Deploy to `tb-builder`'s `public_html` directory:
    92 
    +      - [ ] Run:
    93 
    +        ```
    94 
    +        sudo -u tb-builder cp manual_${PIPELINEID}.zip ~tb-builder/public_html/.
    95 
    +        ```
    96 
    +      - [`sudo` documentation for TPO machines](https://gitlab.torproject.org/tpo/tpa/team/-/wikis/doc/accounts#changingresetting-your-passwords)
    97 
    +  - [ ] `ChangeLog-TBB.txt`: ensure correctness
    98 
    +    - [ ] Browser name correct
    99 
    +    - [ ] Release date correct
    100 
    +    - [ ] No Android updates
    101 
    +    - [ ] All issues added under correct platform
    102 
    +    - [ ] ESR updates correct
    103 
    +    - [ ] Component updates correct
    104 
    +- [ ] Open MR with above changes, using the template for release preparations
    105 
    +- [ ] Merge
    106 
    +- [ ] Sign+Tag
    107 
    +  - **NOTE** this must be done by one of:
    108 
    +    - boklm
    109 
    +    - dan
    110 
    +    - ma1
    111 
    +    - morgan
    112 
    +    - pierov
    113 
    +  - [ ] Run:
    114 
    +    ```
    115 
    +    make torbrowser-signtag-release
    116 
    +    ```
    117 
    +  - [ ] Push tag to `upstream`
    118 
    +- [ ] Build the tag:
    119 
    +  - [ ] Run:
    120 
    +    ```
    121 
    +    make torbrowser-release && make torbrowser-incrementals-release
    122 
    +    ```
    123 
    +    - [ ] Tor Project build machine
    124 
    +    - [ ] Local developer machine
    125 
    +  - [ ] Submit build request to Mullvad infrastructure:
    126 
    +    - **NOTE** this requires a devmole authentication token
    127 
    +    - [ ] Run:
    128 
    +      ```
    129 
    +      make torbrowser-kick-devmole-build
    130 
    +      ```
    131 
    +
    132 
    +</details>
    133 
    +
    134 
    +<details>
    135 
    +  <summary>Website</summary>
    136 
    +
    137 
    +  ### downloads: https://gitlab.torproject.org/tpo/web/tpo.git
    138 
    +  - [ ] `databags/versions.ini`: Update the downloads versions
    139 
    +      - `torbrowser-stable/version`: catch-all for latest stable version
    140 
    +      - `torbrowser-alpha/version`: catch-all for latest alpha version
    141 
    +      - `torbrowser-legacy/version`: catch-all for latest ESR-115 version
    142 
    +      - `torbrowser-*-stable/version`: platform-specific stable versions
    143 
    +      - `torbrowser-*-alpha/version`: platform-specific alpha versions
    144 
    +      - `torbrowser-*-legacy/version`: platform-specific legacy versions
    145 
    +      - `tor-stable`,`tor-alpha`: set by tor devs, do not touch
    146 
    +  - [ ] Push to origin as new branch and create MR
    147 
    +  - [ ] Review
    148 
    +  - [ ] Merge
    149 
    +    - **⚠️ WARNING**: Do not deploy yet!
    150 
    +
    151 
    +</details>
    152 
    +
    153 
    +<details>
    154 
    +  <summary>Signing</summary>
    155 
    +
    156 
    +### release signing
    157 
    +- [ ] Assign this issue to the signer, one of:
    158 
    +  - boklm
    159 
    +  - ma1
    160 
    +  - morgan
    161 
    +  - pierov
    162 
    +- [ ] Ensure all builders have matching builds
    163 
    +- [ ] On `${STAGING_SERVER}`, ensure updated:
    164 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N} && git checkout tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N}`
    165 
    +  - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    166 
    +    - `ssh_host_builder`: ssh hostname of machine with unsigned builds
    167 
    +    - `ssh_host_linux_signer`: ssh hostname of linux signing machine
    168 
    +    - `builder_tor_browser_build_dir`: path on `ssh_host_builder` to root of builder's `tor-browser-build` clone containing unsigned builds
    169 
    +  - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    170 
    +    - `appstoreconnect_api_key_path`: path to json file containing appstoreconnect api key infos
    171 
    +  - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    172 
    +    - `tbb_version`: tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    173 
    +    - `tbb_version_build`: the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    174 
    +    - `tbb_version_type`: either `alpha` for alpha releases or `release` for stable releases
    175 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    176 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, run do-all-signing script:
    177 
    +  - [ ] Run:
    178 
    +    ```
    179 
    +    cd tor-browser-build/tools/signing/ && ./do-all-signing.torbrowser
    180 
    +    ```
    181 
    +  - **NOTE**: on successful execution, the signed binaries and mars should have been copied to `staticiforme` and update responses pushed
    182 
    +
    183 
    +</details>
    184 
    +
    185 
    +<details>
    186 
    +  <summary>Signature verification</summary>
    187 
    +
    188 
    +  <details>
    189 
    +    <summary>Check whether the .exe files got properly signed and timestamped</summary>
    190 
    +
    191 
    +```bash
    192 
    +# Point OSSLSIGNCODE to your osslsigncode binary
    193 
    +pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    194 
    +OSSLSIGNCODE=/path/to/osslsigncode
    195 
    +../../../tools/authenticode_check.sh
    196 
    +popd
    197 
    +```
    198 
    +
    199 
    +  </details>
    200 
    +  <details>
    201 
    +    <summary>Check whether the MAR files got properly signed</summary>
    202 
    +
    203 
    +```bash
    204 
    +# Point NSSDB to your nssdb containing the mar signing certificate
    205 
    +# Point SIGNMAR to your signmar binary
    206 
    +# Point LD_LIBRARY_PATH to your mar-tools directory
    207 
    +pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    208 
    +NSSDB=/path/to/nssdb
    209 
    +SIGNMAR=/path/to/mar-tools/signmar
    210 
    +LD_LIBRARY_PATH=/path/to/mar-tools/
    211 
    +../../../tools/marsigning_check.sh
    212 
    +popd
    213 
    +```
    214 
    +
    215 
    +  </details>
    216 
    +</details>
    217 
    +
    218 
    +<details>
    219 
    +  <summary>Publishing</summary>
    220 
    +
    221 
    +### website
    222 
    +- [ ] On `staticiforme.torproject.org`, static update components:
    223 
    +  ```
    224 
    +  static-update-component cdn.torproject.org && static-update-component dist.torproject.org
    225 
    +  ```
    226 
    +- [ ] Deploy `tor-website` MR
    227 
    +- [ ] On `staticiforme.torproject.org`, remove old release:
    228 
    +  - **NOTE**: Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    229 
    +  - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    230 
    +  - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    231 
    +  - [ ] Run:
    232 
    +    ```
    233 
    +    static-update-component cdn.torproject.org && static-update-component dist.torproject.org
    234 
    +    ```
    235 
    +- [ ] **(Optional)** Generate and deploy new update responses
    236 
    +  - **NOTE**: This is only required if there will be no corresponding 14.0 release (i.e. this is an emergency legacy-only 13.5 release). Normally, legacy update responses are generated and deployed as part of the 14.0 release.
    237 
    +  - **⚠️ WARNING**: This is a little bit off the beaten track, ping boklm or morgan if you have any doubts
    238 
    +  - From the `maint-14.0` branch:
    239 
    +    - [ ] Update `rbm.conf`
    240 
    +      - [ ] `var/torbrowser_legacy_version`: update to `${TOR_BROWSER_VERSION}`
    241 
    +        - **NOTE** this is the browser version for the legacy branch, not the 14.0 branch
    242 
    +      - [ ] `var/torbrowser_legacy_platform_version`: update to `${ESR_VERSION}`
    243 
    +        - **NOTE** this is ESR version for the legacy branch, not the 14.0 branch
    244 
    +    - [ ] Generate update responses:
    245 
    +      - [ ] Run:
    246 
    +        ```
    247 
    +        make torbrowser-update_responses-release
    248 
    +        ```
    249 
    +  - On `staticiforme.torproject.org`, deploy new update responses:
    250 
    +    - **NOTE**: for now this is a bit janky, we should somehow update the workflow to be a bit less hacky
    251 
    +    - [ ] Edit an existing `deploy_update_responses-release.sh` script in your `HOME` directory with the newly pushed commit hash
    252 
    +      - **example**: (hash: `d938943`)
    253 
    +        ```bash
    254 
    +        #!/bin/bash
    255 
    +        set -e
    256 
    +
    257 
    +        echo "Deploying version 14.0"
    258 
    +        echo "update_responses_commit: d938943"
    259 
    +
    260 
    +        cd "/srv/aus1-master.torproject.org/htdocs/torbrowser"
    261 
    +        git fetch
    262 
    +        changed_files="$(git diff --name-only HEAD d938943)"
    263 
    +        if echo "$changed_files" | grep -qv "release"
    264 
    +        then
    265 
    +          echo >&2 "Error: checking out new update_response_commit will changes"
    266 
    +          echo >&2 "some files outside of the release directory:"
    267 
    +          echo "$changed_files" | grep -v "release" >&2
    268 
    +          echo >&2 "--"
    269 
    +          echo >&2 "If this is really what you want to do, edit this script to"
    270 
    +          echo >&2 "remove the line 'exit 1' and run it again."
    271 
    +          echo >&2 "See tor-browser-build#41168 for more details."
    272 
    +          exit 1
    273 
    +        fi
    274 
    +        git checkout "d938943"
    275 
    +
    276 
    +        static-update-component aus1.torproject.org
    277 
    +        ```
    278 
    +    - [ ] Enable update responses:
    279 
    +      ```bash
    280 
    +      sudo -u tb-release ./deploy_update_responses-release.sh
    281 
    +      ```
    282 
    +
    283 
    +</details>
    284 
    +
    285 
    +<details>
    286 
    +  <summary>Communications</summary>
    287 
    +
    288 
    +### tor-announce mailing list
    289 
    +- [ ] Email tor-announce mailing list
    290 
    +  - **Recipients**
    291 
    +    ```
    292 
    +    tor-announce@lists.torproject.org
    293 
    +    ```
    294 
    +  - **Subject**
    295 
    +    ```
    296 
    +    New Release: Tor Browser ${TOR_BROWSER_VERSION} (Windows, macOS)
    297 
    +    ```
    298 
    +  - **Body**
    299 
    +    ```
    300 
    +    Hi everyone,
    301 
    +
    302 
    +    Tor Browser ${TOR_BROWSER_VERSION} has now been published for legacy Windows and macOS platforms. For details please see our blog post:
    303 
    +    - ${BLOG_POST_URL}
    304 
    +
    305 
    +    Changelog:
    306 
    +    # paste changelog as quote here
    307 
    +    ```
    308 
    +
    309 
    +</details>
    310 
    +
    311 
    +/label ~"Release Prep"

  • .gitlab/issue_templates/Release Prep - Tor Browser Stable.md
    1 
    +- **NOTE** It is assumed the `tor-browser` release rebase and security backport tasks have been completed
    2 
    +- **NOTE** This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue
    3 
    +
    1 4 
     <details>
    2 5 
       <summary>Explanation of variables</summary>
    3 6
    4 
    -- `$(BUILD_SERVER)` : the server the main builder is using to build a tor-browser release
    5 
    -- `$(BUILDER)` : whomever is building the release on the $(BUILD_SERVER)
    6 
    -  - **example** : `pierov`
    7 
    -- `$(STAGING_SERVER)` : the server the signer is using to to run the signing process
    8 
    -- `$(ESR_VERSION)` : the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc
    9 
    -  - **example** : `91.6.0`
    10 
    -- `$(TOR_BROWSER_MAJOR)` : the Tor Browser major version
    11 
    -  - **example** : `11`
    12 
    -- `$(TOR_BROWSER_MINOR)` : the Tor Browser minor version
    13 
    -  - **example** : either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    14 
    -- `$(TOR_BROWSER_VERSION)` : the Tor Browser version in the format
    15 
    -  - **example** : `12.5a3`, `12.0.3`
    16 
    -- `$(BUILD_N)` : a project's build revision within a its branch; this is separate from the `$(TOR_BROWSER_BUILD_N)` value; many of the Firefox-related projects have a `$(BUILD_N)` suffix and may differ between projects even when they contribute to the same build.
    17 
    -  - **example** : `build1`
    18 
    -- `$(TOR_BROWSER_BUILD_N)` : the tor-browser build revision for a given Tor Browser release; used in tagging git commits
    19 
    -  - **example** : `build2`
    20 
    -  - **NOTE** : A project's `$(BUILD_N)` and `$(TOR_BROWSER_BUILD_N)` may be the same, but it is possible for them to diverge. For example :
    21 
    -    - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the `$(BUILD_N)` value will increase, while the `$(TOR_BROWSER_BUILD_N)` value may stay at `build1` (but the `$(TOR_BROWSER_VERSION)` will increase)
    22 
    -    - if we have build failures unrelated to `tor-browser`, the `$(TOR_BROWSER_BUILD_N)` value will increase while the `$(BUILD_N)` will stay the same.
    23 
    -- `$(TOR_BROWSER_VERSION)` : the published Tor Browser version
    24 
    -    - **example** : `11.5a6`, `11.0.7`
    25 
    -- `$(TBB_BUILD_TAG)` : the `tor-browser-build` build tag used to build a given Tor Browser version
    26 
    -    - **example** : `tbb-12.0.7-build1`
    27 
    -</details>
    7 
    +- `${BUILD_SERVER}`: the server the main builder is using to build a browser release
    8 
    +- `${BUILDER}`: whomever is building the release on the ${BUILD_SERVER}
    9 
    +  - **example**: `pierov`
    10 
    +- `${STAGING_SERVER}`: the server the signer is using to to run the signing process
    11 
    +- `${ESR_VERSION}`: the Mozilla defined ESR version, used in various places for building browser tags, labels, etc
    12 
    +  - **example**: `91.6.0`
    13 
    +- `${TOR_BROWSER_MAJOR}`: the Tor Browser major version
    14 
    +  - **example**: `11`
    15 
    +- `${TOR_BROWSER_MINOR}`: the Tor Browser minor version
    16 
    +  - **example**: either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    17 
    +- `${TOR_BROWSER_VERSION}`: the Tor Browser version in the format
    18 
    +  - **example**: `12.5a3`, `12.0.3`
    19 
    +- `${BUILD_N}`: a project's build revision within a its branch; this is separate from the `${TOR_BROWSER_BUILD_N}` value; many of the Firefox-related projects have a `${BUILD_N}` suffix and may differ between projects even when they contribute to the same build.
    20 
    +  - **example**: `build1`
    21 
    +- `${TOR_BROWSER_BUILD_N}`: the tor-browser build revision for a given Tor Browser release; used in tagging git commits
    22 
    +  - **example**: `build2`
    23 
    +  - **⚠️ WARNING**: A project's `${BUILD_N}` and `${TOR_BROWSER_BUILD_N}` may be the same, but it is possible for them to diverge. For example :
    24 
    +    - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the `${BUILD_N}` value will increase, while the `${TOR_BROWSER_BUILD_N}` value may stay at `build1` (but the `${TOR_BROWSER_VERSION}` will increase)
    25 
    +    - if we have build failures unrelated to `tor-browser`, the `${TOR_BROWSER_BUILD_N}` value will increase while the `${BUILD_N}` will stay the same.
    26 
    +- `${TOR_BROWSER_VERSION}`: the published Tor Browser version
    27 
    +    - **example**: `11.5a6`, `11.0.7`
    28 
    +- `${TBB_BUILD_TAG}`: the `tor-browser-build` build tag used to build a given Tor Browser version
    29 
    +  - **example**: `tbb-12.5a7-build1`
    30 
    +- `${RELEASE_DATE}`: the intended release date of this browser release; for ESR schedule-driven releases, this should match the upstream Firefox release date
    31 
    +  - **example**: `2024-10-29`
    28 32
    29 
    -**NOTE** It is assumed that the `tor-browser` stable rebase and security backport tasks have been completed
    30 
    -**NOTE** This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue
    33 
    +</details>
    31 34
    32 35 
     <details>
    33 
    -  <summary>Building</summary>
    36 
    +  <summary>Build Configuration</summary>
    34 37
    35 38 
     ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    36 
    -Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)` (and possibly more specific) branches.
    37 
    -
    38 
    -- [ ] Update `rbm.conf`
    39 
    -  - [ ] `var/torbrowser_version` : update to next version
    40 
    -  - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)`
    41 
    -  - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building.
    42 
    -  - [ ] `var/torbrowser_legacy_version` : update to next version in the legacy-13.5 branch
    43 
    -  - [ ] `var/torbrowser_legacy_platform_version` : update to firefox platform version in the legacy-13.5 branch
    44 
    -  - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version
    45 
    -    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    46 
    -    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    47 
    -- [ ] Update Desktop-specific build configs
    48 
    -  - [ ] Update `projects/firefox/config`
    49 
    -    - [ ] `browser_build` : update to match `tor-browser` tag
    50 
    -    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    51 
    -- [ ] Update Android-specific build configs
    52 
    -  - [ ] Update `projects/geckoview/config`
    53 
    -    - [ ] `browser_build` : update to match `tor-browser` tag
    54 
    -    - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(ESR_VERSION)` if rebased
    55 
    -  - [ ] ***(Optional)*** Update `projects/tor-android-service/config`
    56 
    -    - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch
    57 
    -  - [ ] ***(Optional)*** Update `projects/application-services/config`:
    58 
    -    **NOTE** we don't currently have any of our own patches for this project
    59 
    -    - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)`
    60 
    -  - [ ] ***(Optional)*** Update `projects/firefox-android/config`:
    61 
    -    - [ ] `fenix_version` : update to match stable `firefox-android` build tag
    62 
    -    - [ ] `browser_branch` : update to match stable `firefox-android` build tag
    63 
    -    - [ ] `browser_build` : update to match stable `firefox-android` build tag
    64 
    -  variant: Beta
    65 
    -- [ ] Update `projects/translation/config`:
    66 
    -  - [ ] run `make list_translation_updates-release` to get updated hashes
    67 
    -  - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    68 
    -  - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    69 
    -  - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    70 
    -- [ ] Update common build configs
    71 
    -  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    72 
    -    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    73 
    -      - [ ] `URL`
    74 
    -      - [ ] `sha256sum`
    75 
    -  - [ ] Check for OpenSSL updates here : https://www.openssl.org/source/
    76 
    -    - [ ] ***(Optional)*** If new 3.0.X version available, update `projects/openssl/config`
    77 
    -      - [ ] `version` : update to next 3.0.X version
    78 
    -      - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball
    79 
    -  - [ ] Check for zlib updates here: https://github.com/madler/zlib/releases
    80 
    -    - [ ] **(Optional)** If new tag available, update `projects/zlib/config`
    81 
    -      - [ ] `version` : update to next release tag
    82 
    -  - [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags
    83 
    -    - [ ] ***(Optional)*** Update `projects/tor/config`
    84 
    -      - [ ] `version` : update to latest non `-alpha` tag (ping dgoulet or ahf if unsure)
    85 
    -  - [ ] Check for go updates here : https://go.dev/dl
    86 
    -    - **NOTE** : In general, Tor Browser Stable uses the latest of the *previous* Stable major series Go version, but there are sometimes exceptions. Check with the anti-censorship team before doing a major version update in case there is incompatibilities.
    87 
    -    - [ ] ***(Optional)*** Update `projects/go/config`
    88 
    -      - [ ] `version` : update go version
    89 
    -      - [ ] `input_files/sha256sum` for `go` : update sha256sum of archive (sha256 sums are displayed on the go download page)
    90 
    -  - [ ] Check for manual updates by running (from `tor-browser-build` root): `./tools/fetch-manual.py`
    91 
    -    - [ ] ***(Optional)*** If new version is available:
    92 
    -      - [ ] Upload the downloaded `manual_$PIPELINEID.zip` file to `tb-build-02.torproject.org`
    93 
    -      - [ ] Deploy to `tb-builder`'s `public_html` directory:
    94 
    -        - `sudo -u tb-builder cp manual_$PIPELINEID.zip ~tb-builder/public_html/.`
    95 
    -      - [ ] Update `projects/manual/config`:
    96 
    -        - [ ] Change the `version` to `$PIPELINEID`
    97 
    -        - [ ] Update `sha256sum` in the `input_files` section
    98 
    -- [ ] Update `ChangeLog-TBB.txt`
    99 
    -  - [ ] Ensure `ChangeLog-TBB.txt` is sync'd between alpha and stable branches
    100 
    -  - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    101 
    -  - [ ] Run `./tools/fetch-changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    102 
    -    - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    103 
    -    - The first time you run this script you will need to generate an access token; the script will guide you
    104 
    -    - `$updateArgs` should be these arguments, depending on what you actually updated:
    105 
    -      - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    106 
    -      - [ ] `--tor`
    107 
    -      - [ ] `--no-script`
    108 
    -      - [ ] `--openssl`
    109 
    -      - [ ] `--zlib`
    110 
    -      - [ ] `--go`
    111 
    -      - E.g., `./tools/fetch-changelogs.py 41028 --date 'December 19 2023' --firefox 115.6.0esr --tor 0.4.8.10 --no-script 11.4.29 --zlib 1.3 --go 1.21.5 --openssl 3.0.12`
    112 
    -    - `--date $date` is optional, if omitted it will be the date on which you run the command
    113 
    -  - [ ] Copy the output of the script to the beginning of `ChangeLog-TBB.txt` and adjust its output
    39 
    +Tor Browser Release are on the `maint-${TOR_BROWSER_MAJOR}.${TOR_BROWSER_MINOR}` branch
    40 
    +
    41 
    +- [ ] Tag `tor-browser` in tor-browser.git
    42 
    +  - **example**: `tor-browser-128.3.0esr-14.0-1-build1`
    43 
    +- [ ] Changelog bookkeeping:
    44 
    +  - [ ] Ensure all commits to `tor-browser` and `tor-browser-build` for this release have an associated issue linked to this release preparation issue
    45 
    +  - [ ] Ensure each issue has a platform (~Windows, ~MacOS, ~Linux, ~Android, ~Desktop, ~"All Platforms") and potentially ~"Build System" labels
    46 
    +- [ ] Create a release preparation branch from the current `maint-XX.Y` branch
    47 
    +- [ ] Run release preparation script:
    48 
    +  - **NOTE**: You can omit the `--tor-browser` argument if this is for a joint Tor and Mullvad Browser release
    49 
    +  ```bash
    50 
    +  ./tools/relprep.py --tor-browser --date ${RELEASE_DATE} ${TOR_BROWSER_VERSION}
    51 
    +  ```
    52 
    +  - **⚠️ WARNING**: You may need to manually update the `firefox/config` and `geckoview/config` files' `browser_build` field if `tor-browser.git` has not yet been tagged (e.g. if security backports have not yet been merged and tagged)
    53 
    +- [ ] Review build configuration changes:
    54 
    +  - [ ] `rbm.conf`
    55 
    +    - [ ] `var/torbrowser_version`: updated to next browser version
    56 
    +    - [ ] `var/torbrowser_build`: updated to `${TOR_BROWSER_BUILD_N}`
    57 
    +    - [ ] `var/browser_release_date`: updated to build date. For the build to be reproducible, the date should be in the past when building.
    58 
    +      - **⚠️ WARNING**: If we have updated `var/torbrowser_build` without updating the `firefox` or `geckoview` tags, then we can leave this unchanged to avoid forcing a firefox re-build (e.g. when bumping `var/torbrwoser_build` to build2, build3, etc due to non-firefox related build issues)
    59 
    +    - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from`: updated to previous Desktop version
    60 
    +      - **NOTE**: We try to build incrementals for the previous 3 desktop versions
    61 
    +      - **⚠️ WARNING**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    62 
    +- [ ] `projects/firefox/config`
    63 
    +    - [ ] `browser_build`: updated to match `tor-browser` tag
    64 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
    65 
    +  - [ ] `projects/geckoview/config`
    66 
    +    - [ ] `browser_build`: updated to match `tor-browser` tag
    67 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
    68 
    +  - [ ] ***(Optional)*** `projects/translation/config`:
    69 
    +    - [ ] `steps/base-browser/git_hash`: updated with `HEAD` commit of project's `base-browser` branch
    70 
    +    - [ ] `steps/tor-browser/git_hash`: updated with `HEAD` commit of project's `tor-browser` branch
    71 
    +    - [ ] `steps/fenix/git_hash`: updated with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    72 
    +  - [ ] ***(Optional)*** `projects/browser/config`:
    73 
    +    - [ ] NoScript: https://addons.mozilla.org/en-US/firefox/addon/noscript
    74 
    +      - [ ] `URL` updated
    75 
    +        - **⚠️ WARNING**: If preparing the release manually, updating the version number in the url is not sufficient, as each version has a random unique id in the download url
    76 
    +      - [ ] `sha256sum` updated
    77 
    +  - [ ] ***(Optional)*** `projects/openssl/config`: https://www.openssl.org/source/
    78 
    +    - **NOTE**: Only if new LTS version (3.0.X currrently) available
    79 
    +    - [ ] `version`: updated to next LTS version
    80 
    +    - [ ] `input_files/sha256sum`: updated to sha256 sum of source tarball
    81 
    +  - [ ] **(Optional)** `projects/zlib/config`: https://github.com/madler/zlib/releases
    82 
    +    - **NOTE**: Only if new tag available
    83 
    +    - [ ] `version`: updated to next release tag
    84 
    +  - [ ] **(Optional)** `projects/zstd/config`: https://github.com/facebook/zstd/releases
    85 
    +    - **NOTE**: Only if new tag available; Android-only for now
    86 
    +    - [ ] `version`: updated to next release tag
    87 
    +    - [ ] `git_hash`: updated to the commit corresponding to the tag (we don't check signatures for Zstandard)
    88 
    +  - [ ] **(Optional)** `projects/tor/config` https://gitlab.torproject.org/tpo/core/tor/-/tags
    89 
    +    - [ ] `version`: updated to latest non `-alpha` tag or release tag if newer (ping **dgoulet** or **ahf** if unsure)
    90 
    +  - [ ] **(Optional)** `projects/go/config` https://go.dev/dl
    91 
    +    - **NOTE**: In general, Tor Browser Alpha uses the latest Stable major series Go version, but there are sometimes exceptions. Check with the anti-censorship team before doing a major version update in case there is incompatibilities.
    92 
    +    - [ ] `version`: updated go version
    93 
    +    - [ ] `input_files/sha256sum` for `go`: update sha256sum of archive (sha256 sums are displayed on the go download page)
    94 
    +  - [ ] **(Optional)** `projects/manual/config`
    95 
    +    - [ ] `version`: updated to latest pipeline id
    96 
    +    - [ ] `input_files/shasum` for `manual`: updated to manual hash
    97 
    +    - [ ] Upload the downloaded `manual_${PIPELINEID}.zip` file to `tb-build-02.torproject.org`
    98 
    +    - [ ] Deploy to `tb-builder`'s `public_html` directory:
    99 
    +      - [ ] Run:
    100 
    +        ```
    101 
    +        sudo -u tb-builder cp manual_${PIPELINEID}.zip ~tb-builder/public_html/.
    102 
    +      ```
    103 
    +      - [`sudo` documentation for TPO machines](https://gitlab.torproject.org/tpo/tpa/team/-/wikis/doc/accounts#changingresetting-your-passwords)
    104 
    +  - [ ] `ChangeLog-TBB.txt`: ensure correctness
    105 
    +    - [ ] Browser name correct
    106 
    +    - [ ] Release date correct
    107 
    +    - [ ] No Android updates on a desktop-only release and vice-versa
    108 
    +    - [ ] All issues added under correct platform
    109 
    +    - [ ] ESR updates correct
    110 
    +    - [ ] Component updates correct
    114 111 
     - [ ] Open MR with above changes, using the template for release preparations
    115 112 
     - [ ] Merge
    116 113 
     - [ ] Sign+Tag
    ... ... @@ -120,47 +117,52 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    120 117 
         - ma1
    121 118 
         - morgan
    122 119 
         - pierov
    123 
    -  - [ ] Run: `make torbrowser-signtag-release`
    120 
    +  - [ ] Run:
    121 
    +    ```
    122 
    +    make torbrowser-signtag-release
    123 
    +    ```
    124 124 
       - [ ] Push tag to `upstream`
    125 125 
     - [ ] Build the tag:
    126 
    -  - Run `make torbrowser-release && make torbrowser-incrementals-release`
    126 
    +  - [ ] Run:
    127 
    +    ```
    128 
    +    make torbrowser-release && make torbrowser-incrementals-release
    129 
    +    ```
    127 130 
         - [ ] Tor Project build machine
    128 131 
         - [ ] Local developer machine
    129 132 
       - [ ] Submit build request to Mullvad infrastructure:
    130 133 
         - **NOTE** this requires a devmole authentication token
    131 
    -    - Run `make torbrowser-kick-devmole-build`
    132 
    -- [ ] Ensure builders have matching builds
    134 
    +    - [ ] Run:
    135 
    +      ```
    136 
    +      make torbrowser-kick-devmole-build
    137 
    +      ```
    133 138
    134 139 
     </details>
    135 140
    136 141 
     <details>
    137 
    -  <summary>Communications</summary>
    138 
    -
    139 
    -### notify stakeholders
    140 
    -- [ ] **(Once builds confirmed matching)** Email tor-qa mailing list with release information
    141 
    -  - [ ] tor-qa: tor-qa@lists.torproject.org
    142 
    -  - **Subject**
    143 
    -    ```
    144 
    -    Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    145 
    -    ```
    146 
    -  - **Body**
    147 
    -    ```
    148 
    -    Hello,
    149 
    -
    150 
    -    Unsigned Tor Browser $(TOR_BROWSER_VERSION) release candidate builds are now available for testing:
    151 
    -
    152 
    -    - https://tb-build-02.torproject.org/~$(BUILDER)/builds/torbrowser/release/unsigned/$(TOR_BROWSER_VERSION)/
    153 
    -
    154 
    -    The full changelog can be found here:
    155 
    -
    156 
    -    - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
    157 
    -    ```
    158 
    -- [ ] Email packagers:
    159 
    -  - [ ] Tails dev mailing list: tails-dev@boum.org
    160 
    -  - [ ] Guardian Project: nathan@guardianproject.info
    161 
    -  - [ ] FreeBSD port: freebsd@sysctl.cz <!-- Gitlab user maxfx -->
    162 
    -  - [ ] OpenBSD port: caspar@schutijser.com <!-- Gitlab user cschutijser -->
    163 
    -  - [ ] Note any changes which may affect packaging/downstream integration
    142 
    +  <summary>Website</summary>
    143 
    +
    144 
    +  ### downloads: https://gitlab.torproject.org/tpo/web/tpo.git
    145 
    +  - [ ] `databags/versions.ini`: Update the downloads versions
    146 
    +      - `torbrowser-stable/version`: catch-all for latest stable version
    147 
    +      - `torbrowser-alpha/version`: catch-all for latest alpha version
    148 
    +      - `torbrowser-legacy/version`: catch-all for latest ESR-115 version
    149 
    +      - `torbrowser-*-stable/version`: platform-specific stable versions
    150 
    +      - `torbrowser-*-alpha/version`: platform-specific alpha versions
    151 
    +      - `torbrowser-*-legacy/version`: platform-specific legacy versions
    152 
    +  - [ ] Push to origin as new branch and create MR
    153 
    +  - [ ] Review
    154 
    +  - [ ] Merge
    155 
    +    - **⚠️ WARNING**: Do not deploy yet!
    156 
    +
    157 
    +  ### blog: https://gitlab.torproject.org/tpo/web/blog.git
    158 
    +  - [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    159 
    +    - [ ] Note any ESR update
    160 
    +    - [ ] Thank any users which have contributed patches
    161 
    +    - [ ] **(Optional)** Draft any additional sections for new features which need testing, known issues, etc
    162 
    +  - [ ] Push to origin as new branch and open MR
    163 
    +  - [ ] Review
    164 
    +  - [ ] Merge
    165 
    +    - **⚠️ WARNING**: Do not deploy yet!
    164 166
    165 167 
     </details>
    166 168
    ... ... @@ -168,38 +170,36 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    168 170 
       <summary>Signing</summary>
    169 171
    170 172 
     ### release signing
    171 
    -- **NOTE** : In practice, it's most efficient to have the blog post and website updates ready to merge, since signing doesn't take very long
    172 173 
     - [ ] Assign this issue to the signer, one of:
    173 174 
       - boklm
    175 
    +  - ma1
    174 176 
       - morgan
    175 
    -- [ ] On `$(STAGING_SERVER)`, ensure updated:
    176 
    -  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N) && git checkout tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N)`
    177 
    +  - pierov
    178 
    +- [ ] Ensure all builders have matching builds
    179 
    +- [ ] Verify the associated legacy `maint-13.5` release has been signed and deployed
    180 
    +  - **⚠️ WARNING**: Do not continue if the legacy channel has not been fully signed and published yet; it is needed for update-response generation!
    181 
    +  - **NOTE** Stable releases without a corresponding legacy release may ignore this
    182 
    +- [ ] On `${STAGING_SERVER}`, ensure updated:
    183 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N} && git checkout tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N}`
    177 184 
       - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    178 
    -    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    179 
    -      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    180 
    -    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    185 
    +    - `ssh_host_builder`: ssh hostname of machine with unsigned builds
    186 
    +    - `ssh_host_linux_signer`: ssh hostname of linux signing machine
    187 
    +    - `builder_tor_browser_build_dir`: path on `ssh_host_builder` to root of builder's `tor-browser-build` clone containing unsigned builds
    181 188 
       - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    182 
    -    - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    189 
    +    - `appstoreconnect_api_key_path`: path to json file containing appstoreconnect api key infos
    183 190 
       - [ ] `set-config.update-responses`
    184 
    -    - `update_responses_repository_dir` : directory where you cloned `git@gitlab.torproject.org:tpo/applications/tor-browser-update-responses.git`
    191 
    +    - `update_responses_repository_dir`: directory where you cloned `git@gitlab.torproject.org:tpo/applications/tor-browser-update-responses.git`
    185 192 
       - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    186 
    -    - `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    187 
    -    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    188 
    -    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    189 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    190 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    191 
    -  - `cd tor-browser-build/tools/signing/`
    192 
    -  - `./do-all-signing.torbrowser`
    193 
    -- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    194 
    -- [ ] Update `staticiforme.torproject.org`:
    195 
    -  - From `screen` session on `staticiforme.torproject.org`:
    196 
    -  - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    197 
    -  - [ ] Enable update responses : `sudo -u tb-release ./deploy_update_responses-release.sh`
    198 
    -  - [ ] Remove old release data from following places:
    199 
    -    - **NOTE** : Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    200 
    -    - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    201 
    -    - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    202 
    -  - [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    193 
    +    - `tbb_version`: tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    194 
    +    - `tbb_version_build`: the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    195 
    +    - `tbb_version_type`: either `alpha` for alpha releases or `release` for stable releases
    196 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    197 
    +- [ ] On `${STAGING_SERVER}` in a separate `screen` session, run do-all-signing script:
    198 
    +  - [ ] Run:
    199 
    +    ```
    200 
    +    cd tor-browser-build/tools/signing/ && ./do-all-signing.torbrowser
    201 
    +    ```
    202 
    +  - **NOTE**: on successful execution, the signed binaries and mars should have been copied to `staticiforme` and update responses pushed
    203 203
    204 204 
     </details>
    205 205
    ... ... @@ -239,6 +239,26 @@ popd
    239 239 
     <details>
    240 240 
       <summary>Publishing</summary>
    241 241
    242 
    +### website
    243 
    +- [ ] On `staticiforme.torproject.org`, static update components:
    244 
    +  ```
    245 
    +  static-update-component cdn.torproject.org && static-update-component dist.torproject.org
    246 
    +  ```
    247 
    +- [ ] Deploy `tor-website` MR
    248 
    +- [ ] Deploy `tor-blog` MR
    249 
    +- [ ] On `staticiforme.torproject.org`, enable update responses:
    250 
    +  ```
    251 
    +  sudo -u tb-release ./deploy_update_responses-release.sh
    252 
    +  ```
    253 
    +- [ ] On `staticiforme.torproject.org`, remove old release:
    254 
    +  - **NOTE**: Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    255 
    +  - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    256 
    +  - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    257 
    +  - [ ] Run:
    258 
    +    ```
    259 
    +    static-update-component cdn.torproject.org && static-update-component dist.torproject.org
    260 
    +    ```
    261 
    +
    242 262 
     ### Google Play: https://play.google.com/apps/publish
    243 263 
     - [ ] Publish APKs to Google Play:
    244 264 
       - Select `Tor Browser` app
    ... ... @@ -253,45 +273,59 @@ popd
    253 273 
         - [ ] 100% rollout when publishing a security-driven release
    254 274 
       - [ ] Update rollout percentage to 100% after confirmed no major issues
    255 275
    256 
    -### website: https://gitlab.torproject.org/tpo/web/tpo.git
    257 
    -- [ ] `databags/versions.ini` : Update the downloads versions
    258 
    -    - `torbrowser-stable/version` : sort of a catch-all for latest stable version
    259 
    -    - `torbrowser-alpha/version` : sort of a catch-all for latest stable version
    260 
    -    - `torbrowser-*-stable/version` : platform-specific stable versions
    261 
    -    - `torbrowser-*-alpha/version` : platform-specific alpha versions
    262 
    -    - `tor-stable`,`tor-alpha` : set by tor devs, do not touch
    263 
    -- [ ] Push to origin as new branch, open 'Draft :' MR
    264 
    -- [ ] Remove `Draft:` from MR once signed-packages are accessible on https://dist.torproject.org
    265 
    -- [ ] Merge
    266 
    -- [ ] Publish after CI passes and builds are published
    276 
    +</details>
    267 277
    268 
    -### blog: https://gitlab.torproject.org/tpo/web/blog.git
    269 
    -- [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    270 
    -  - [ ] Note any ESR update
    271 
    -  - [ ] Note any updates to dependencies (OpenSSL, zlib, NoScript, tor, etc)
    272 
    -  - [ ] Thank any users which have contributed patches
    273 
    -- [ ] Push to origin as new branch, open `Draft:` MR
    274 
    -- [ ] Merge once signed-packages are accessible on https://dist.torproject.org
    275 
    -- [ ] Publish after CI passes and website has been updated
    278 
    +<details>
    279 
    +  <summary>Communications</summary>
    276 280
    277 281 
     ### tor-announce mailing list
    278 
    -- [ ] Email tor-announce mailing list: tor-announce@lists.torproject.org
    282 
    +- [ ] Email tor-announce mailing list
    283 
    +  - **Recipients**
    284 
    +    ```
    285 
    +    tor-announce@lists.torproject.org
    286 
    +    ```
    279 287 
       - **Subject**
    280 288 
         ```
    281 
    -    New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    289 
    +    New Release: Tor Browser ${TOR_BROWSER_VERSION} (Android, Windows, macOS, Linux)
    282 290 
         ```
    283 291 
       - **Body**
    284 292 
         ```
    285 293 
         Hi everyone,
    286 294
    287 
    -    Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    288 
    -    - $(BLOG_POST_URL)
    295 
    +    Tor Browser ${TOR_BROWSER_VERSION} has now been published for all platforms. For details please see our blog post:
    296 
    +    - ${BLOG_POST_URL}
    289 297
    290 298 
         Changelog:
    291 
    -    # paste changleog as quote here
    299 
    +    # paste changelog as quote here
    292 300 
         ```
    293 301
    302 
    +### packagers
    303 
    +- [ ] Email packagers:
    304 
    +  - **Recipients**
    305 
    +    - Tails dev mailing list: tails-dev@boum.org
    306 
    +    - Guardian Project: nathan@guardianproject.info
    307 
    +    - FreeBSD port: freebsd@sysctl.cz <!-- Gitlab user maxfx -->
    308 
    +    - OpenBSD port: caspar@schutijser.com <!-- Gitlab user cschutijser -->
    309 
    +    - torbrowser-launcher: mail@asciiwolf.com <!-- Gitlab user asciiwolf -->
    310 
    +    - Anti-Censorship: meskio@torproject.org <!-- Gitlab user meskio -->
    311 
    +    ```
    312 
    +    tails-dev@boum.org nathan@guardianproject.info freebsd@sysctl.cz caspar@schutijser.com mail@asciiwolf.com meskio@torproject.org
    313 
    +    ```
    314 
    +  - **Subject**
    315 
    +    ```
    316 
    +    New Release: Tor Browser ${TOR_BROWSER_VERSION} (Android, Windows, macOS, Linux)
    317 
    +    ```
    318 
    +  - **Body**
    319 
    +    ```
    320 
    +    Hi everyone,
    321 
    +
    322 
    +    Tor Browser ${TOR_BROWSER_VERSION} has now been published for all platforms. For details please see our blog post:
    323 
    +    - ${BLOG_POST_URL}
    324 
    +
    325 
    +    Changelog:
    326 
    +    # paste changelog as quote here
    327 
    +    ```
    328 
    +  - [ ] Note any changes which may affect packaging/downstream integration
    294 329 
     </details>
    295 330
    296 331 
     /label ~"Release Prep"
    297 
    -

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help